Can't get websites to use respective SSL certs

Question

iTim2009 Author

Level 1

36 points

Can't get websites to use respective SSL certs

Mac OS 10.10.5

Server 5.0.15

I have an issue where the default website ("Server Website (SSL)") is conflicting with the SSL certificates for my other three SSL websites.

My website configuration (note: server IP is 192.168.1.100)

Server Website SSL (All IP Addresses) - cert for domain1.com (works)
Domain1.com SSL (192.168.1.10) - cert for domain1.com (works)
Domain2.com SSL (192.168.1.20) - cert for domain2.com (pulls cert for domain1.com, invalid identity)
Domain3.com SSL (192.168.1.30) - cert for domain3.com (pulls cert for domain1.com, invalid identity)

My DNS Records:

Primary Zone - Domain1.com
- A: Domain1.com 192.168.1.10
- NS: Domain1.com
Primary Zone - Domain2.com
- A: Domain2.com 192.168.1.20
- NS: Domain2.com
Primary Zone - Domain3.com
- A: Domain3.com 192.168.1.30
- NS: Domain3.com
Reverse Zone - 1.168.192.in-addr.arpa
- PTR: 192.168.1.10 Domain1.com
- PTR: 192.168.1.20 Domain2.com
- PTR: 192.168.1.30 Domain3.com
- NS: Domain1.com
- NS: Domain2.com
- NS: Domain3.com
Reverse Zone - 100.1.168.192.in-addr.arpa
- PTR: 192.168.1.100 server.domain1.com
- NS: server.domain1.com

Whatever cert is selected for the default website applies to every SSL website. The only way I can force them all to use their respective certs is to set the website IP to be the same as the server IP (192.168.1.100 in this example). It works, but that prevents profile manager from working.

I'm 99% sure I have my DNS set up correctly (right now all A records point to 192.168.1.100 as a temporary solution), but I'm willing to take another look if someone has a concise and clear suggestion. Ideally each DomainX.com would have an IP of .10, .20, and .30.

So how can I make all three websites use different IPs AND their respective certificates? Is this possible?

(I appreciate any suggestions at this point. This question is impossible to find an answer anywhere on the internet after about 9 months of searching.)

Mac mini, OS X Server

Posted on Mar 15, 2016 6:56 AM

Reply

Answer 1

iTim2009 Author

Level 1

36 points

Mar 15, 2016 6:54 PM in response to iTim2009

Solution for anyone else who comes searching for this problem!

After talking to Apple Enterprise support:

The website services goes on the assumption that you only have one certificate for any and all websites. Unless you really want to roll your sleeves and get down and dirty with Apache config files, you have to have a certificate that is valid for all domains you are using AND give every website its own IP address.

When you setup your certificate, the hostname should look something like this:

server.domain1.com (this is your common name)

*.domain1.com

*.domain2.com, etc.

I used a StartCom Class 2 IV SSL certificate ($59/yr).

Then assuming you know how to import a verified certificate, use that for all services that need it and all websites that you want secure (why would you not use https anyway?)

Reply