golowenow wrote
I run X2 with 2 completely different websites. In other words two separate domains. Am wondering if the new version of Abyss will support multiple SSL certificates and be able to assign the appropriate certificate for the requested website? If this is not so then perhaps that would be a suggestion for the new version.
Unfortunately the answer is not a full "yes". It depends. Actually, there is a limitation in the SSL protocol itself to have only a single certificate on a given port/IP address.
So the solutions to have two SSL websites on the same computer are the following:
* Both hosts will not share the same port/IP. In other words, you can have each of them use its own port or have both of them using the same port but configure "Bind to IP" to a different IP address (assuming you have two network cards or two different routers).
* You can purchase a single certificate with two different domain names in it (some certification authorities support that feature and can generate such certificates).
* If both domain names differ slightly (for example mail.mysite.com and
www.mysite.com), you can get a single certificate for *.mysite.com and use it for both of them.
Please find below the explanation of this SSL limitation which affects all web servers on the market:
* When you type
https://www.mysite.com/path/to/page.html in your browser, it will contact the IP corresponding of
www.mysite.com on port 443 (the default HTTPS port).
* As soon as the connection is accepted, the SSL negciation starts: the browser will send a list of encryption systems it handles to the server, and the server will choose one of them for subsequent communications.
* Next, the server will send the SSL certificate to the browser.
* The browser will decode the certificate, validate it (by verifying some checksums)
* If everything is fine, the real HTTP dialog can start.
* The browser will send the following request (using the the public key contained in the SSL certificate already exchanged):
GET /path/to/page.html HTTP/1.1
Host: www.mysite.com
User-Agent: Mozilla 5/0
Note that it's only at that stage that the Host header has been sent by the browser. It's already late for the server to change the SSL certificate.
That's why it is primordial that the SSL certificate on the port 443 in that case matches with
www.mysite.com . Otherwise, the browser will report that the name of domain in the certificate received by the server is not the same as the one you have tried accessing.
Hopefully, things are changing and a new version of SSL (not yet standardized) will overcome that limitation. But it is not yet supported by most browsers. So we have to wait for a few years until more browsers with that feature will become widely available.