SNI for Multiple Hosts on Lighttpd

Question

Inherited lighttpd server, I'm somewhat clueless on it. Trying to use SNI to install a 3rd SSL cert without another IP. Currently the SSL config in lighttpd.conf looks like so:

$SERVER["socket"] == ":443" {
  ssl.engine = "enable"
  ssl.pemfile = "/etc/ssl/private/domain1.com.pem"
  ssl.ca-file = "/etc/ssl/private/chain.cer"
  $HTTP["host"] == "domain2.com" {          
     ssl.pemfile = "/etc/ssl/private/domain2.com.pem"
     ssl.ca-file = "/etc/ssl/private/chain.cer"
  }
}

Trying to add the 3rd cert, like so:

$SERVER["socket"] == ":443" {
  ssl.engine = "enable"
  ssl.pemfile = "/etc/ssl/private/domain1.com.pem"
  ssl.ca-file = "/etc/ssl/private/chain.cer"
  $HTTP["host"] == "domain2.com" {          
     ssl.pemfile = "/etc/ssl/private/domain2.com.pem"
     ssl.ca-file = "/etc/ssl/private/chain.cer"
  }
  $HTTP["host"] == "domain3.com" {          
     ssl.pemfile = "/etc/ssl/private/domain3.com.pem"
  }
}

Something not working about it, lighttpd won't start/restart when the config looks like this.

*won't start/restart* - in this case I would expect that you will find log messages which indicate a problem. Did you look? — Steffen Ullrich, May 15 '17 at 19:17
There doesn't seem to be much in the log - just that it was stopped and then started again (after I removed the extra lines). — the.s.brom, May 15 '17 at 19:24
so it did actually start based on the log files? because you've wrote that it did not start. — Steffen Ullrich, May 15 '17 at 19:28
As I wrote, it started after I removed the new lines. Can't just leave the server sitting there not running. :D — the.s.brom, May 15 '17 at 19:30

score 2 · Accepted Answer · answered May 15 '17 at 19:43

2

Is your domain3.com.pem file correct?

Lighttpd uses a slightly less common construction where the ssl.pemfile should not only contain the signed certificate that your CA returned to you, it should also contain the associated private key.

It should look like:

-----BEGIN CERTIFICATE-----
ABC...
-----END CERTIFICATE-----
-----BEGIN PRIVATE KEY-----
ABC...
-----END PRIVATE KEY----

answered May 15 '17 at 19:43

HBruijn

77,029
24
135
201

THANK YOU. My key and crt were reversed in the pem. Fixed the file and it worked. – the.s.brom May 15 '17 at 19:50

SNI for Multiple Hosts on Lighttpd

1 Answers1