-1

Is it possible to have a different SSL configuration per url path in the same domain? My dilemma is as follows:

I've been using SSLyze (https://github.com/nabla-c0d3/sslyze) and SSLLabs Server Test (https://www.ssllabs.com/ssltest/) to see whether a particular domain is configured correctly. However, none of those tools goes down to a specific url path.

For example, if test.com has a particular SSL config and test.com/app has another particular SSL config, then those two tools would not be able to check test.com/app's configuration. Is this a valid concern or are SSL configurations tied to the domain and cannot differ depending on the url path?

user7157588
  • 1

1 Answers1

0

Is it possible to have a different SSL configuration per url path in the same domain?

No, this is not possible. SSL/TLS is negotiated with a particular host and port. The server doesn't even receive the HTTP request, which contains the path, until an HTTPS session has been established.

SSL configurations tied to the domain and cannot differ depending on the url path?

Correct. The domain / host plus the port. The path is part of the HTTP request, so it's actually "protected" by HTTPS.

vcsjones
  • 138,677
  • 31
  • 291
  • 286