0

Feeding off of this post.

I have a domain with Dreamhost and i've purchased SSL certificate for it.

I am moving over the server files to Linode but and setting the DNS in dreamhost to point over.

Linode provides a ip but it's not dedicated.

What is going to happen to SSL on that dreamhost IP when I switch over the DNS to linode?

I have one virtual host can I host multiple domains while using SSL for one?

ThomasReggi
  • 621
  • 2
  • 10
  • 25

3 Answers3

2

You need a own IP for each SSL-domain. You can of course have one SSL-site plus multiple non-ssl sites on a single IP.

There is the option of using Server Name Indication, but since it's only implemented in a minority of browsers it is not a real choice.

Zulakis
  • 4,153
  • 14
  • 48
  • 76
  • Most browsers actually do support SNI, but you're right that it's still not a real choice - IE on Windows XP still makes up too large of a proportion of the client browsers on the internet. – Shane Madden Jun 23 '12 at 22:22
0

Your IP address should be dedicated to your VPS. However, you will have to have Dreamhost, or whoever you purchased your SSL to reassign it, witch may take time. It will also make the new server the one with the correct SSL signature therefore your old server will display a certificate error. The only way to avoid this would be to get a multi-site SSL (expensive) or buy a second SSL certificate (cheap).

Travis Pessetto
  • 166
  • 1
  • 5
0

The certificate and host name verification are done by the client, using the host name as requested by the client.

This means that the IP address of the server isn't really relevant: what matters is that whatever requests a connection to the host name end up being connected to a server that has a certificate valid for that host name.

For example, if you have a dynamic IP address and a dynamic DNS service (e.g. example.dyndns.org) updated whenever the IP address changes, a DNS CNAME entry from www.mydomain.example pointing to example.dyndns.org, and a certificate valid for www.mydomain.example, a client requesting a connection to www.mydomain.example will indeed get a certificate valid for www.mydomain.example, and this will work irrespectively of the IP address. (This being said, for serious hosting, a fixed IP address is better.)

A good way to make the transition is to redirect all the traffic (on ports 80 and 443) from the old machine to the new machine, using an iptables forward rule (or similar). This should allow for a smooth transition while the DNS update is propagated across all servers.

This way, the clients requesting www.mydomain.example would be effectively served by your new server, whether www.mydomain.example points to your old IP address or the new one.

What is going to happen to SSL on that dreamhost IP when I switch over the DNS to linode?

Depending on how much you trust your old hosting company, you may want to revoke the old certificate and get a new one (some CAs allow re-keying for free during the life-time of the certificate). Otherwise, your old hosting company may still technically have access to your private key (and could be able to use that certificate).

I have one virtual host can I host multiple domains while using SSL for one?

If you're talking about multiple plain HTTP virtual hosts with a single HTTPS virtual host, yes, this is clearly possible with your certificate. If you want more than one HTTPS virtual host on a single IP address, you'd have to use multiple certificates with Server Name Indication (not supported by some browsers, in particular Windows XP, Java 6 and some mobile clients) or a single certificate valid for all the names you want to serve (with multiple Subject Alternative Names).

Bruno
  • 4,099
  • 1
  • 21
  • 37
  • In the dreamhost admin there are three different keys can I use these in apache on another server? I'm still pretty confused. – ThomasReggi Jun 28 '12 at 21:44
  • I furthered this discussion here ... http://serverfault.com/questions/403186/setting-up-ssl-on-apache-on-linux-ubuntu – ThomasReggi Jun 28 '12 at 21:51