Hi I've got a few Plone sites set-up using Apache through Zope. The question is, I'd like to implement SSL on the site login etc, as it's not secure without this. There's also one site I'd like to serve completely over https. However. I'm told that you can't run SSL on virtual hosts and can only have once SSL site per IP address. What would be the way round this? I know I could set-up SSL on Zope only using the following documentation: http://www.zope.org/Members/Ioan/ZopeSSL but if I can't carry this through to Apache then I'd have to run Zope as the web server as well as the application server. Thanks Michael
On 24 Jan 2006, at 14:30, michael nt milne wrote:
Hi
I've got a few Plone sites set-up using Apache through Zope. The question is, I'd like to implement SSL on the site login etc, as it's not secure without this. There's also one site I'd like to serve completely over https. However. I'm told that you can't run SSL on virtual hosts and can only have once SSL site per IP address.
What would be the way round this? I know I could set-up SSL on Zope only using the following documentation:
http://www.zope.org/Members/Ioan/ZopeSSL
but if I can't carry this through to Apache then I'd have to run Zope as the web server as well as the application server.
You can run SSL on virtual hosts, but Apache cannot present different server certificates to the browser based on virtual hosts. So every virtual host with a hostname that does not match the certificate Apache presents on the IP will produce nasty popup boxes on clients. To prevent those warnings you *must* use separate IPs for every SSL- secured hostname you plan on serving, so the statement "one SSL site per IP" is basically correct. I don't know if making Zope serve out SSL directly helps that (I doubt it) because I wouldn't consider using it. jens
Jens Vagelpohl schrieb:
...
I don't know if making Zope serve out SSL directly helps that (I doubt it) because I wouldn't consider using it.
No, it does not. You only add the hassle to deal with nasty zope patches to the scene. Only IP per ssl-host helps :-) Regards Tino
On 24 Jan 2006, at 14:59, Tino Wildenhain wrote:
Jens Vagelpohl schrieb: ...
I don't know if making Zope serve out SSL directly helps that (I doubt it) because I wouldn't consider using it.
No, it does not. You only add the hassle to deal with nasty zope patches to the scene. Only IP per ssl-host helps :-)
Yes, the fact that all those "make Zope speak HTTPS"-solutions consist of patches and hacks is the exact reason why I would never consider them. I wanted to stay polite. ;) jens
Ok, thanks. The annoying thing is that I am renting a virtual dedicated server which allows multiple domain names obviously but not multiple IP addresses. Or it probably costs more for that. Do you reckon SSL will ever be available for virtual single IP based hosts? On 1/24/06, Jens Vagelpohl <jens@dataflake.org> wrote:
On 24 Jan 2006, at 14:59, Tino Wildenhain wrote:
Jens Vagelpohl schrieb: ...
I don't know if making Zope serve out SSL directly helps that (I doubt it) because I wouldn't consider using it.
No, it does not. You only add the hassle to deal with nasty zope patches to the scene. Only IP per ssl-host helps :-)
Yes, the fact that all those "make Zope speak HTTPS"-solutions consist of patches and hacks is the exact reason why I would never consider them. I wanted to stay polite. ;)
jens
_______________________________________________ Zope maillist - Zope@zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )
On 24 Jan 2006, at 15:12, michael nt milne wrote:
Ok, thanks. The annoying thing is that I am renting a virtual dedicated server which allows multiple domain names obviously but not multiple IP addresses. Or it probably costs more for that. Do you reckon SSL will ever be available for virtual single IP based hosts?
No I don't. jens
I guess though that the pop-up for the certificate only happens once for each client when they enter the site? On 1/24/06, Jens Vagelpohl <jens@dataflake.org> wrote:
On 24 Jan 2006, at 15:12, michael nt milne wrote:
Ok, thanks. The annoying thing is that I am renting a virtual dedicated server which allows multiple domain names obviously but not multiple IP addresses. Or it probably costs more for that. Do you reckon SSL will ever be available for virtual single IP based hosts?
No I don't.
jens
_______________________________________________ Zope maillist - Zope@zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )
On 24 Jan 2006, at 15:46, michael nt milne wrote:
On 1/24/06, Jens Vagelpohl < jens@dataflake.org> wrote: On 24 Jan 2006, at 15:12, michael nt milne wrote:
Ok, thanks. The annoying thing is that I am renting a virtual dedicated server which allows multiple domain names obviously but not multiple IP addresses. Or it probably costs more for that. Do you reckon SSL will ever be available for virtual single IP based hosts?
No I don't. I guess though that the pop-up for the certificate only happens once for each client when they enter the site?
yes jens
I think this should be doable for single cert with multiple domains. Setup you exising ip with one domain (ie. mysecure_domain.com). Get the cert on this domain. Setup a rewrite rule in apache for port 443 for mysecure_domain.com You could use a self signed cert to experiment. When user logs in request login page goes to site1 - http://domain_one.com: You would need to make your login go to you login page https://mysecure_domain/site1/login site2 - http://domain_two.com: https://mysecure_domain/site2/login Once logged in goes to whatever you have in your vhm http://www.domain_one.com /site1 in vhm http://www.domain_two.com /site2 in vhm in vhm you'd have: www.domain_one.com /site1 www.mysecure_domain/site1 /site1 www.domain_two.com /site2 www.mysecure_domain/site2 /site2 The problem here will be the session since when you login secure and switch back to the regular site, your ssl session will expire automatically but you'll need to pass it to nonssl to stay alive when you go back to nonssl. I think a solution might be to store it, go to nonssl and then retreive it when you do your redirect back to non-ssl. I have not tried this yet. Alternatively you could always stay in ssl from that point forward. Any technique from someone on this would be helpful since I am also interested in what possibilities there might be. This should not give you a problem with the cert because identity on cert would match the ip. I think otherwise you are in a situation where you will need a dedicated server setup to have one ip per site and then you can just do a single rewrite per ip or use chained ssl if you have sub domains that you want to tie together under a single cert over one or more ips on one or more servers. Regards, David
On 24 Jan 2006, at 18:10, David Pratt wrote:
I think this should be doable for single cert with multiple domains. Setup you exising ip with one domain (ie. mysecure_domain.com). Get the cert on this domain.
<snip> Have you tested this? The authentication machinery uses cookies, and the browser will not send cookies that were set by the secure login host to the unsecured sites. jens
Hi Jens. I tried something similar to this about a year ago as an experiment. I think the problem I had at the time with with session expiring and I was thinking about storing the session data in the database and retrieving it back when user went back to non-ssl. This was a while ago and I did not follow it through at the time. I am use CMF not Plone however. Regards, David Jens Vagelpohl wrote:
On 24 Jan 2006, at 18:10, David Pratt wrote:
I think this should be doable for single cert with multiple domains. Setup you exising ip with one domain (ie. mysecure_domain.com). Get the cert on this domain.
<snip>
Have you tested this? The authentication machinery uses cookies, and the browser will not send cookies that were set by the secure login host to the unsecured sites.
jens
_______________________________________________ Zope maillist - Zope@zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )
Would it work if you carried the SSL through and continued the session? On 1/24/06, David Pratt <fairwinds@eastlink.ca> wrote:
Hi Jens. I tried something similar to this about a year ago as an experiment. I think the problem I had at the time with with session expiring and I was thinking about storing the session data in the database and retrieving it back when user went back to non-ssl. This was a while ago and I did not follow it through at the time. I am use CMF not Plone however.
Regards, David
Jens Vagelpohl wrote:
On 24 Jan 2006, at 18:10, David Pratt wrote:
I think this should be doable for single cert with multiple domains. Setup you exising ip with one domain (ie. mysecure_domain.com). Get the cert on this domain.
<snip>
Have you tested this? The authentication machinery uses cookies, and the browser will not send cookies that were set by the secure login host to the unsecured sites.
jens
_______________________________________________ Zope maillist - Zope@zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )
_______________________________________________ Zope maillist - Zope@zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )
Ok thanks very much for this. Much appreciated. On 1/24/06, michael nt milne <michael.milne@gmail.com> wrote:
Would it work if you carried the SSL through and continued the session?
On 1/24/06, David Pratt <fairwinds@eastlink.ca> wrote:
Hi Jens. I tried something similar to this about a year ago as an experiment. I think the problem I had at the time with with session expiring and I was thinking about storing the session data in the database and retrieving it back when user went back to non-ssl. This was a while ago and I did not follow it through at the time. I am use CMF not Plone however.
Regards, David
Jens Vagelpohl wrote:
On 24 Jan 2006, at 18:10, David Pratt wrote:
I think this should be doable for single cert with multiple domains. Setup you exising ip with one domain (ie. mysecure_domain.com). Get the cert on this domain.
<snip>
Have you tested this? The authentication machinery uses cookies, and the browser will not send cookies that were set by the secure login host to the unsecured sites.
jens
_______________________________________________ Zope maillist - Zope@zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )
_______________________________________________ Zope maillist - Zope@zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )
Jens Vagelpohl wrote:
On 24 Jan 2006, at 18:10, David Pratt wrote: Have you tested this? The authentication machinery uses cookies, and the browser will not send cookies that were set by the secure login host to the unsecured sites.
...only if the secure bit of the cookie is set ;-) Chris -- Simplistix - Content Management, Zope & Python Consulting - http://www.simplistix.co.uk
On 25 Jan 2006, at 14:26, Chris Withers wrote:
Jens Vagelpohl wrote:
On 24 Jan 2006, at 18:10, David Pratt wrote: Have you tested this? The authentication machinery uses cookies, and the browser will not send cookies that were set by the secure login host to the unsecured sites.
...only if the secure bit of the cookie is set ;-)
This is about different hostnames, remember? jens
Jens Vagelpohl wrote:
...only if the secure bit of the cookie is set ;-)
This is about different hostnames, remember?
Well, in that case https has nothing to do with it ;-) cookies for one domain never get sent to another, unless you're using IE or something ;-) Chris -- Simplistix - Content Management, Zope & Python Consulting - http://www.simplistix.co.uk
Ok, that's really interesting. Thanks. Yes I could just stay using SSL after the login if there's a problem with going non-ssl I understand the setting up the single secure domain bit linked to the IP address but don't quite get how I would link each site's login areas to that? Basically are you saying you would, using re-write rules, just call http://www.plonesiteone.com/login_form - http://mysecure_domain.com/plonesiteone/login_form ? It would be the same Plone login page but just have a different URL in the address bar, a https one? Also would you need to use VHM because I've got Apache virtual hosts set-up without actually doing anything in Zope. As long as VHM is on it is all fine. Thanks Michael On 1/24/06, David Pratt <fairwinds@eastlink.ca> wrote:
I think this should be doable for single cert with multiple domains. Setup you exising ip with one domain (ie. mysecure_domain.com). Get the cert on this domain.
Setup a rewrite rule in apache for port 443 for mysecure_domain.com
You could use a self signed cert to experiment. When user logs in request login page goes to
site1 - http://domain_one.com: You would need to make your login go to you login page https://mysecure_domain/site1/login
site2 - http://domain_two.com: https://mysecure_domain/site2/login
Once logged in goes to whatever you have in your vhm http://www.domain_one.com /site1 in vhm http://www.domain_two.com /site2 in vhm
in vhm you'd have: www.domain_one.com /site1 www.mysecure_domain/site1 /site1 www.domain_two.com /site2 www.mysecure_domain/site2 /site2
The problem here will be the session since when you login secure and switch back to the regular site, your ssl session will expire automatically but you'll need to pass it to nonssl to stay alive when you go back to nonssl. I think a solution might be to store it, go to nonssl and then retreive it when you do your redirect back to non-ssl. I have not tried this yet. Alternatively you could always stay in ssl from that point forward. Any technique from someone on this would be helpful since I am also interested in what possibilities there might be.
This should not give you a problem with the cert because identity on cert would match the ip. I think otherwise you are in a situation where you will need a dedicated server setup to have one ip per site and then you can just do a single rewrite per ip or use chained ssl if you have sub domains that you want to tie together under a single cert over one or more ips on one or more servers.
Regards, David
Hi Michael. First you need a way to get to the root of your site two different ways. First is using the domain you have your ssl on and the other for your other domain name(s) www.domain_one.com /site1 www.mysecure_domain.com/site1 /site1 If you have apache proxy then you can set up yoru ssl on port 443 to secure the domain you have the cert for. Under this domain you can have any number of sites so long as the domain and ip are the same. ie www.mysecure_domain.com/site1 www.mysecure_domain.com/site2 www.mysecure_domain.com/site3 ... So you will be able to get to the same site by either using ie http://www.domain_one.com or https://www.mysecure_domain.com/site1 http://www.domain_two.com or https://www.mysecure_domain.com/site2 http://www.domain_three.com or https://www.mysecure_domain.com/site3 since in VHM they are both pointing to the same root (/site1 ) As far as the login on Plone, I do not use Plone but you would have to modify the zpt and script that calls the login to modify these links to the url to for the other domain. This is where I cannot be sure of what I did a year ago. I know for sure I had not completely worked it through and would need to look at this again. I tried this on CMF. Give me a day or two and I will see if I can locate anything more on this in my stuff. I wish I had a better memory but a year seems like a long time ago. :-) Regards, David michael nt milne wrote:
Ok, that's really interesting. Thanks. Yes I could just stay using SSL after the login if there's a problem with going non-ssl
I understand the setting up the single secure domain bit linked to the IP address but don't quite get how I would link each site's login areas to that? Basically are you saying you would, using re-write rules, just call http://www.plonesiteone.com/login_form - http://mysecure_domain.com/plonesiteone/login_form ?
It would be the same Plone login page but just have a different URL in the address bar, a https one?
Also would you need to use VHM because I've got Apache virtual hosts set-up without actually doing anything in Zope. As long as VHM is on it is all fine.
Thanks
Michael
On 1/24/06, *David Pratt* <fairwinds@eastlink.ca <mailto:fairwinds@eastlink.ca>> wrote:
I think this should be doable for single cert with multiple domains. Setup you exising ip with one domain (ie. mysecure_domain.com). Get the cert on this domain.
Setup a rewrite rule in apache for port 443 for mysecure_domain.com
You could use a self signed cert to experiment. When user logs in request login page goes to
site1 - http://domain_one.com: You would need to make your login go to you login page https://mysecure_domain/site1/login
site2 - http://domain_two.com: https://mysecure_domain/site2/login <https://mysecure_domain/site2/login>
Once logged in goes to whatever you have in your vhm http://www.domain_one.com /site1 in vhm http://www.domain_two.com /site2 in vhm
in vhm you'd have: www.domain_one.com /site1 www.mysecure_domain/site1 /site1 www.domain_two.com /site2 www.mysecure_domain/site2 /site2
The problem here will be the session since when you login secure and switch back to the regular site, your ssl session will expire automatically but you'll need to pass it to nonssl to stay alive when you go back to nonssl. I think a solution might be to store it, go to nonssl and then retreive it when you do your redirect back to non-ssl. I have not tried this yet. Alternatively you could always stay in ssl from that point forward. Any technique from someone on this would be helpful since I am also interested in what possibilities there might be.
This should not give you a problem with the cert because identity on cert would match the ip. I think otherwise you are in a situation where you will need a dedicated server setup to have one ip per site and then you can just do a single rewrite per ip or use chained ssl if you have sub domains that you want to tie together under a single cert over one or more ips on one or more servers.
Regards, David
Michael. I found a bookmark for something that might help. I remember this person had written a bit of a howto on some of this for Plone. His name was Eric Vought and his howto was SSL redirect around March of last year. His document which is now an orphan was at: http://www.diversityink.com/documents/2005/1Q/howto-apache-zope-ssl I don't know where he is any longer but perhaps someone on the plone list could help find the doc or Eric. If you happen to find a copy of the howto somewhere, I would be great if you could send a fresh link to me. I remember communicating with Eric at the time when I was trying to work this out for myself with CMF. Regards, David David Pratt wrote:
Hi Michael. First you need a way to get to the root of your site two different ways. First is using the domain you have your ssl on and the other for your other domain name(s)
www.domain_one.com /site1 www.mysecure_domain.com/site1 /site1
If you have apache proxy then you can set up yoru ssl on port 443 to secure the domain you have the cert for. Under this domain you can have any number of sites so long as the domain and ip are the same. ie
www.mysecure_domain.com/site1 www.mysecure_domain.com/site2 www.mysecure_domain.com/site3 ...
So you will be able to get to the same site by either using ie http://www.domain_one.com or https://www.mysecure_domain.com/site1
http://www.domain_two.com or https://www.mysecure_domain.com/site2
http://www.domain_three.com or https://www.mysecure_domain.com/site3
since in VHM they are both pointing to the same root (/site1 )
As far as the login on Plone, I do not use Plone but you would have to modify the zpt and script that calls the login to modify these links to the url to for the other domain. This is where I cannot be sure of what I did a year ago. I know for sure I had not completely worked it through and would need to look at this again. I tried this on CMF. Give me a day or two and I will see if I can locate anything more on this in my stuff. I wish I had a better memory but a year seems like a long time ago. :-)
Regards, David
michael nt milne wrote:
Ok, that's really interesting. Thanks. Yes I could just stay using SSL after the login if there's a problem with going non-ssl
I understand the setting up the single secure domain bit linked to the IP address but don't quite get how I would link each site's login areas to that? Basically are you saying you would, using re-write rules, just call http://www.plonesiteone.com/login_form - http://mysecure_domain.com/plonesiteone/login_form ?
It would be the same Plone login page but just have a different URL in the address bar, a https one?
Also would you need to use VHM because I've got Apache virtual hosts set-up without actually doing anything in Zope. As long as VHM is on it is all fine.
Thanks
Michael
On 1/24/06, *David Pratt* <fairwinds@eastlink.ca <mailto:fairwinds@eastlink.ca>> wrote:
I think this should be doable for single cert with multiple domains. Setup you exising ip with one domain (ie. mysecure_domain.com). Get the cert on this domain.
Setup a rewrite rule in apache for port 443 for mysecure_domain.com
You could use a self signed cert to experiment. When user logs in request login page goes to
site1 - http://domain_one.com: You would need to make your login go to you login page https://mysecure_domain/site1/login
site2 - http://domain_two.com: https://mysecure_domain/site2/login <https://mysecure_domain/site2/login>
Once logged in goes to whatever you have in your vhm http://www.domain_one.com /site1 in vhm http://www.domain_two.com /site2 in vhm
in vhm you'd have: www.domain_one.com /site1 www.mysecure_domain/site1 /site1 www.domain_two.com /site2 www.mysecure_domain/site2 /site2
The problem here will be the session since when you login secure and switch back to the regular site, your ssl session will expire automatically but you'll need to pass it to nonssl to stay alive when you go back to nonssl. I think a solution might be to store it, go to nonssl and then retreive it when you do your redirect back to non-ssl. I have not tried this yet. Alternatively you could always stay in ssl from that point forward. Any technique from someone on this would be helpful since I am also interested in what possibilities there might be.
This should not give you a problem with the cert because identity on cert would match the ip. I think otherwise you are in a situation where you will need a dedicated server setup to have one ip per site and then you can just do a single rewrite per ip or use chained ssl if you have sub domains that you want to tie together under a single cert over one or more ips on one or more servers.
Regards, David
_______________________________________________ Zope maillist - Zope@zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )
michael nt milne schrieb:
Ok, thanks. The annoying thing is that I am renting a virtual dedicated server which allows multiple domain names obviously but not multiple IP addresses. Or it probably costs more for that. Do you reckon SSL will ever be available for virtual single IP based hosts?
Well to really puzzle you, ssl can work with more then one certificate per IP - but not https (http-ssl). You can work with all protocols (SMTP, IMAP, ...) which support start-tls. However this does not help with your current project and was just a sidenote to be complete. Regards Tino
On 1/24/06, michael nt milne <michael.milne@gmail.com> wrote:
Ok, thanks. The annoying thing is that I am renting a virtual dedicated server which allows multiple domain names obviously but not multiple IP addresses. Or it probably costs more for that. Do you reckon SSL will ever be available for virtual single IP based hosts?
I believe you can use SSL and name based virtual hosts if you use unique ports for each vhost. I've never done it myself, but I remember reading that somewhere in Apache documentation that it was possible. Jeff D
Jeff Donsbach schrieb:
On 1/24/06, michael nt milne <michael.milne@gmail.com> wrote:
Ok, thanks. The annoying thing is that I am renting a virtual dedicated server which allows multiple domain names obviously but not multiple IP addresses. Or it probably costs more for that. Do you reckon SSL will ever be available for virtual single IP based hosts?
I believe you can use SSL and name based virtual hosts if you use unique ports for each vhost. I've never done it myself, but I remember reading that somewhere in Apache documentation that it was possible.
Well we are telling exactly this all the time here in this thread :-) But strictly speaking its not "name based" vhost if you use the IP address to determine the vhost. It usually has a name too (and it has to - in order for the certificate to work) And for the hosting provider, dont believe they know all and everything. Been there, seen so much... ;) Regards Tino
"David Pratt -Hi Michael. First you need a way to get to the root of your site two different ways. First is using the domain you have your ssl on and the other for your other domain name(s)" Thanks for that David. I will try out what you say.Hopefully it will work because not being able to do multiple virtual hosts on SSL is a real problem. "Jonathan Cyr <cyrj@cyr.info>to ZOPE.org More options Jan 24 (14 hours ago) You can have one HTTPS/SSL per IP per port." Jonathan, so this would mean using one IP address with SSL on multiple port addresses , 90, 100, 110 etc etc which would then match to the Plone 8080 port? The port doesn't have to be 443? On 1/25/06, Tino Wildenhain <tino@wildenhain.de> wrote:
Jeff Donsbach schrieb:
On 1/24/06, michael nt milne <michael.milne@gmail.com> wrote:
Ok, thanks. The annoying thing is that I am renting a virtual dedicated server which allows multiple domain names obviously but not multiple IP addresses. Or it probably costs more for that. Do you reckon SSL will ever be available for virtual single IP based hosts?
I believe you can use SSL and name based virtual hosts if you use unique ports for each vhost. I've never done it myself, but I remember reading that somewhere in Apache documentation that it was possible.
Well we are telling exactly this all the time here in this thread :-) But strictly speaking its not "name based" vhost if you use the IP address to determine the vhost. It usually has a name too (and it has to - in order for the certificate to work)
And for the hosting provider, dont believe they know all and everything.
Been there, seen so much... ;)
Regards Tino
On 1/24/06, michael nt milne <michael.milne@gmail.com> wrote:
Ok, thanks. The annoying thing is that I am renting a virtual dedicated server which allows multiple domain names obviously but not multiple IP addresses. Or it probably costs more for that. Do you reckon SSL will ever be available for virtual single IP based hosts?
No, because it is a technical limitation. The SSL certificate is used to encrypt the channel to the client. As the named virtual host selection is based on the Host header sent over this encrypted channel, you cannot use a SSL certificate per named virtual host. Hence the limitation of one SSL certificate per IP address. You can work around this limitation if all your virtual hosts share the same top-level domain name, by using a wildcard certificate. For example, for all example.com virtual hosts, one *.example.com SSL certificate can be used without the browser ever complaining about a name mismatch. -- Martijn Pieters
Hi The virtual hosts are all served from the same server but they don't actually share the same domain. They have different domain names but are served from the same IP. I'm going to try David Pratt's method above to set up a mysecure.domain.com and then use Apache to re-write in and out of the login areas etc. Thanks for all the help Michael On 1/25/06, Martijn Pieters <mj@zopatista.com> wrote:
On 1/24/06, michael nt milne <michael.milne@gmail.com> wrote:
Ok, thanks. The annoying thing is that I am renting a virtual dedicated server which allows multiple domain names obviously but not multiple IP addresses. Or it probably costs more for that. Do you reckon SSL will ever be available for virtual single IP based hosts?
No, because it is a technical limitation. The SSL certificate is used to encrypt the channel to the client. As the named virtual host selection is based on the Host header sent over this encrypted channel, you cannot use a SSL certificate per named virtual host. Hence the limitation of one SSL certificate per IP address.
You can work around this limitation if all your virtual hosts share the same top-level domain name, by using a wildcard certificate. For example, for all example.com virtual hosts, one *.example.com SSL certificate can be used without the browser ever complaining about a name mismatch.
-- Martijn Pieters
michael nt milne schrieb:
Hi
I've got a few Plone sites set-up using Apache through Zope. The question is, I'd like to implement SSL on the site login etc, as it's not secure without this. There's also one site I'd like to serve completely over https. However. I'm told that you can't run SSL on virtual hosts and can only have once SSL site per IP address.
Not entirely correct. You can run ssl over VirtualHosts but they have to bind to different IP addresses. NameBasedVHosts (only) cannot serve different ssl-certificates. As said, if you have one IP address per certificate you can easily set up Apache Vhosts as proxy to zope with ssl. HTH Tino Wildenhain
You can have one HTTPS/SSL per IP per port. I use Pound instead of Apache, and can run an instance for each port. I use HTTPS on port 444, and 445 for testing/staging arrangements that match the production HTTPS on 443. I can set up a self-signed or 3rd party certificate for each port, and the domain is set in each new certificate. And simply use a standard web page to redirect to the new HTTPS port. (https://stagingarea.something.com:444/directory) Also, you can use Pound to virtual host SSL sites, but the certificate will not match, and a warning to the user. If you accept the warning, you are secure, but not very friendly. Pound can be found at http://www.pound.ch/pound and is very Zope friendly. This is not a user-friendly solution for production-level sites, but great for staging/testing/experimental/admin needs. Not sure, if this helps, -Jon michael nt milne wrote:
Hi
I've got a few Plone sites set-up using Apache through Zope. The question is, I'd like to implement SSL on the site login etc, as it's not secure without this. There's also one site I'd like to serve completely over https. However. I'm told that you can't run SSL on virtual hosts and can only have once SSL site per IP address.
What would be the way round this? I know I could set-up SSL on Zope only using the following documentation:
http://www.zope.org/Members/Ioan/ZopeSSL
but if I can't carry this through to Apache then I'd have to run Zope as the web server as well as the application server.
Thanks
Michael ------------------------------------------------------------------------
_______________________________________________ Zope maillist - Zope@zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )
-- Jonathan Cyr http://www.cyr.info http://www.weddingweblog.com cyrj@cyr.info
er.... Pound can be found at http://www.apsis.ch/pound -Jon Jonathan Cyr wrote:
You can have one HTTPS/SSL per IP per port.
I use Pound instead of Apache, and can run an instance for each port.
I use HTTPS on port 444, and 445 for testing/staging arrangements that match the production HTTPS on 443. I can set up a self-signed or 3rd party certificate for each port, and the domain is set in each new certificate. And simply use a standard web page to redirect to the new HTTPS port. (https://stagingarea.something.com:444/directory)
Also, you can use Pound to virtual host SSL sites, but the certificate will not match, and a warning to the user. If you accept the warning, you are secure, but not very friendly.
Pound can be found at http://www.pound.ch/pound and is very Zope friendly.
This is not a user-friendly solution for production-level sites, but great for staging/testing/experimental/admin needs. Not sure, if this helps,
-Jon
michael nt milne wrote:
Hi
I've got a few Plone sites set-up using Apache through Zope. The question is, I'd like to implement SSL on the site login etc, as it's not secure without this. There's also one site I'd like to serve completely over https. However. I'm told that you can't run SSL on virtual hosts and can only have once SSL site per IP address.
What would be the way round this? I know I could set-up SSL on Zope only using the following documentation:
http://www.zope.org/Members/Ioan/ZopeSSL
but if I can't carry this through to Apache then I'd have to run Zope as the web server as well as the application server.
Thanks
Michael ------------------------------------------------------------------------
_______________________________________________ Zope maillist - Zope@zope.org http://mail.zope.org/mailman/listinfo/zope ** No cross posts or HTML encoding! ** (Related lists - http://mail.zope.org/mailman/listinfo/zope-announce http://mail.zope.org/mailman/listinfo/zope-dev )
-- Jonathan Cyr http://www.cyr.info http://www.weddingweblog.com cyrj@cyr.info
michael nt milne wrote:
I'd like to implement SSL on the site login etc, as it's not secure without this. There's also one site I'd like to serve completely over https. However. I'm told that you can't run SSL on virtual hosts and can only have once SSL site per IP address.
To vary either IP address or port for different SSL site is a common method and gives you the biggest advantages. Nevetheless, you can host multiple SSL sites on single IP:port combination, provided you share also a single certificate for them. Apache is able to serve one cert for multiple SSL sites. To prevent the annoying client-side dialog box saying the cert is for different domain, your certificate must be a little special. There are 2 ways I'm aware of to manage this: 1) Wildcard certificate, issued for *.domain.com. This way the certificate will match <anything>.domain.com, but <anything> must not contain a dot. Also I'm not sure whether all current browsers support this technique. 2) The subjectAltName capability as described here: http://wiki.cacert.org/wiki/VhostsApache. Note that the CommonName must be repeated as the first subjectAltName, since it's ignored afterwards. I'm currently on my way to test the second way for my sites, but preliminary tests went well. -- \//\/\ (Sometimes credited as BA92 C339 6DD2 51F6 BACB 4C1B 5470 360E 20E5 926D.) [ When you find a virus in mail from me, then I intended to infect you, ] [ since I use SW that is not distributing malware w/o my knowledge. ]
participants (9)
-
Chris Withers -
David Pratt -
Jeff Donsbach -
Jens Vagelpohl -
Jonathan Cyr -
Martijn Pieters -
michael nt milne -
Tino Wildenhain -
Vlada Macek