Results 1 to 8 of 8

Thread: Installing SSL SAN certificate

  1. #1
    Registered Member
    Join Date
    Feb 2005
    Posts
    263

    Default Installing SSL SAN certificate

    We have the following setup:

    Account "foo" with a primary domain and an "intranet." subdomain, both on the same IP (obviously, since that's a cPanel limitation). We have been issued an SSL SAN certificate which should cover both the domain and the subdomain (both will need https protection in places). Since they're both on the same IP, the certificate should cover both just fine.

    We temporarily installed a self-signed cert on the intranet subdomain. Now we want to install the real cert so that it covers both domains.

    What is the correct procedure for this?

    Thanks.

  2. #2
    cPanel Staff cPanelTristan's Avatar
    Join Date
    Oct 2010
    Location
    somewhere over the rainbow
    Posts
    7,611
    cPanel Access Level

    Root Administrator

    Default Re: Installing SSL SAN certificate

    Is an SSL SAN certificate the same as a wildcard certificate or a UCC certificate?
    cPResources: Support Options | More Support Options | Forums Search | cPanel.net Site Search | Mailing Lists(Alt) | Docs
    -- Tristan, Technical Analyst III, Forums Specialist, cPanel Tech Support

    Submit a ticket | Check an existing ticket

  3. #3
    Registered Member
    Join Date
    Feb 2005
    Posts
    263

    Default Re: Installing SSL SAN certificate

    Hi Tristan - Essentially, yes, though I'm no expert on this. From the FAQ:

    Does this system have the capability to do Subject Alternative Name (SAN) certificates where we can use one certificate with multiple DNS hostnames per IP address?

    Yes, the following types of certificates are supported [note: EV certs coming March 3, 2011]: Comodo EV SGC SSL (EV/SAN), Comodo EV Multi Domain SSL, InCommon Wildcard SSL Certificate, InCommon SSL, InCommon Intranet SSL (secure internal servers using either a full server name or a private IP address), InCommon Unified Communications Certificate (UCC/SAN), InCommon Multi Domain SSL, Corporate Secure Email Certificate.
    https://wikihub.berkeley.edu/display...ficate+Service

  4. #4
    cPanel Staff cPanelTristan's Avatar
    Join Date
    Oct 2010
    Location
    somewhere over the rainbow
    Posts
    7,611
    cPanel Access Level

    Root Administrator

    Default Re: Installing SSL SAN certificate

    Does the account have a dedicated IP or it is using the shared IP? If it is a dedicated IP, simply install that new certificate in WHM > SSL/TLS > Install a SSL Certificate and Setup the Domain area.

    If you wish to remove the prior certificate, you could remove it in WHM > SSL/TLS > Manage SSL Hosts area. Please ensure to have the CSR, key, crt and cabundle files before removing the existing certificate.

    After installation, ensure to copy the /var/cpanel/userdata/username/domain.com_SSL file to /var/cpanel/userdata/username/intranet.domain.com_SSL location and revise as appropriate for the home directory path. After revising, you would then rebuild Apache and restart it:

    Code:
    cp /usr/local/apache/conf/httpd.conf /usr/local/apache/conf/httpd.conf.bak110922
    /scripts/rebuildhttpdconf
    /etc/init.d/httpd restart
    cPResources: Support Options | More Support Options | Forums Search | cPanel.net Site Search | Mailing Lists(Alt) | Docs
    -- Tristan, Technical Analyst III, Forums Specialist, cPanel Tech Support

    Submit a ticket | Check an existing ticket

  5. #5
    Registered Member
    Join Date
    Feb 2005
    Posts
    263

    Default Re: Installing SSL SAN certificate

    Thanks for this response Tristan. What I'm seeing when running rebuildhttpdconf is this:

    warn [rebuildhttpdconf] Failed to resolve duplicate SSL VirtualHosts: intranet.domain.edu_SSL and domain.edu_SSL
    Built /usr/local/apache/conf/httpd.conf OK

    After restarting apache, the site is not available. I modified the documentroot, the homediar, the serveralias and the servername.

    Any ideas there? Thanks.

  6. #6
    cPanel Staff cPanelTristan's Avatar
    Join Date
    Oct 2010
    Location
    somewhere over the rainbow
    Posts
    7,611
    cPanel Access Level

    Root Administrator

    Default Re: Installing SSL SAN certificate

    Which site is not available? Both sites or just one of them, and by not available do you mean on http or https or both? Also, do they have entries in /usr/local/apache/conf/httpd.conf for the 443?

    Also, you should compare the settings in intranet.domain.edu to what you put into intranet.domain.edu_SSL to ensure they match for those options. If they do not match, revise the intranet.domain.edu_SSL to match those of intranet.domain.edu rather than what you previously used.
    cPResources: Support Options | More Support Options | Forums Search | cPanel.net Site Search | Mailing Lists(Alt) | Docs
    -- Tristan, Technical Analyst III, Forums Specialist, cPanel Tech Support

    Submit a ticket | Check an existing ticket

  7. #7
    Registered Member
    Join Date
    Feb 2005
    Posts
    263

    Default Re: Installing SSL SAN certificate

    Ah, I didn't look at the file intranet.domain.edu. Will follow up on this tomorrow. Thanks.

  8. #8
    Registered Member
    Join Date
    Feb 2005
    Posts
    263

    Default Re: Installing SSL SAN certificate

    Thanks Tristan! That did the trick - had to modify both files to have unique homedirs and other identifying data, while leaving the path to the cert and key files identical. Wonderful - one cert covering two domains on the same IP, like magic.

    Note for others: the rebuild step still issues the warning:

    warn [rebuildhttpdconf] Failed to resolve duplicate SSL VirtualHosts: intanet.domain.edu_SSL and domain.edu_SSL

    but after restarting apache, it does work just fine.

    Would be nice to see WHM make this a bit easier to configure, though it's probably not a very common use case.

    I appreciate your help.

    ./s
    Last edited by shacker23; 09-23-2011 at 07:38 PM.

Similar Threads

  1. Having trouble installing an SSL certificate.
    By Gordon Rankin in forum Security
    Replies: 4
    Last Post: 06-10-2013, 09:50 AM
  2. Intsalling SAN SSL Certificate
    By rsbcbe in forum Security
    Replies: 0
    Last Post: 05-05-2012, 03:45 AM
  3. Installing SSL certificate
    By apc1 in forum General Discussion
    Replies: 7
    Last Post: 09-08-2005, 01:01 AM
  4. Problem installing SSL certificate
    By xperience2 in forum General Discussion
    Replies: 4
    Last Post: 12-18-2003, 11:17 AM
bargain