Enabling SNI support for Addon domains using Include Editor

[tdubs]

Hi CPanel/WHM community,

I have a quick question. I'm trying to secure multiple addon domains that are pointing to one server and one IP address using SNI. While it's not yet supported by CPanel, it is supported by the version of Apache that I am running.

Is it possible to add virtual hosts using the Include Editor for Apache?

I found this guide, Using Multiple SSL Certificates in Apache with One IP Address, but I'm not sure if its as easy as typing...

<NameVirtualHost *:443>

<VirtualHost *:443>
ServerName www.yoursite.com
DocumentRoot /var/www/site
SSLEngine on
SSLCertificateFile /path/to/www_yoursite_com.crt
SSLCertificateKeyFile /path/to/www_yoursite_com.key
SSLCertificateChainFile /path/to/DigiCertCA.crt
</Virtual Host>

<VirtualHost *:443>
ServerName www.yoursite2.com
DocumentRoot /var/www/site2
SSLEngine on
SSLCertificateFile /path/to/www_yoursite2_com.crt
SSLCertificateKeyFile /path/to/www_yoursite2_com.key
SSLCertificateChainFile /path/to/DigiCertCA.crt
</Virtual Host>

...for my domains.

Is securing multiple domains through SNI even possible using the Include Editor?

- - - Updated - - -

And I should have said:

"I'm not sure if its as easy as typing into the Include Editor box"...

 

[Infopro]

While it's not yet supported by CPanel, it is supported by the version of Apache that I am running.

Which one are you running?

The docs might be helpful to you:
Include Editor - cPanel Documentation

 

[tdubs]

I'm running WHM 11.36.1 build 5 and cPanel 11 that is optimized for a VPS. My hosting provider said that my version of cPanel does not yet support SNI.

- - - Updated - - -

I've read the docs. Is it as simple as entering the following text into either the Pre or Post VirtualHost? These are just example domains.

<NameVirtualHost *:443>

<VirtualHost *:443>
 ServerName www.yoursite.com
 DocumentRoot /var/www/site
 SSLEngine on
 SSLCertificateFile /path/to/www_yoursite_com.crt
 SSLCertificateKeyFile /path/to/www_yoursite_com.key
 SSLCertificateChainFile /path/to/DigiCertCA.crt
</Virtual Host>

<VirtualHost *:443>
 ServerName www.yoursite2.com
 DocumentRoot /var/www/site2
 SSLEngine on
 SSLCertificateFile /path/to/www_yoursite2_com.crt
 SSLCertificateKeyFile /path/to/www_yoursite2_com.key
 SSLCertificateChainFile /path/to/DigiCertCA.crt
</Virtual Host>

 

[robb3369]

SNI will be supported in the coming WHM 11.38 build...

However, for testing purposes, you can jump up to the EDGE version (11.37), which is supposed to have SNI support.

SSL Improvements for cPanel & WHM | cPanel Blog

 

[tdubs]

I'm not a server administrator, so excuse my naivete, but if Apache supports SNI and WHM + cPanel does not support SNI, then I can still run SNI on the server, I just can't configure and control it from WHM or cPanel, correct?

 

[cPanelKenneth]

I'm not a server administrator, so excuse my naivete, but if Apache supports SNI and WHM + cPanel does not support SNI, then I can still run SNI on the server, I just can't configure and control it from WHM or cPanel, correct?

You are correct that you can do things manually to get SNI working. If you have access to the Apache configuration file, that tells me you have root access to the server. I strongly encourage you to upgrade to cPanel & WHM 11.38 to get SNI support. This way you can get SNI working in a method that is compatible with cPanel & WHM, and can be managed using the SSL Management interfaces we provide.

Whether you do this manually, or upgrade to cPanel & WHM 11.38, you will also need to be using CentOS 6, RHEL 6, or CloudLinux 6 for SNI to function. While Apache has long supported SNI, the OpenSSL library has not. The version of the OpenSSL library provided on older versions of CentOS, CloudLinux, and RHEL, do not support SNI.

 

[rogerw]

You are correct that you can do things manually to get SNI working. If you have access to the Apache configuration file, that tells me you have root access to the server. I strongly encourage you to upgrade to cPanel & WHM 11.38 to get SNI support. This way you can get SNI working in a method that is compatible with cPanel & WHM, and can be managed using the SSL Management interfaces we provide.

Whether you do this manually, or upgrade to cPanel & WHM 11.38, you will also need to be using CentOS 6, RHEL 6, or CloudLinux 6 for SNI to function. While Apache has long supported SNI, the OpenSSL library has not. The version of the OpenSSL library provided on older versions of CentOS, CloudLinux, and RHEL, do not support SNI.

I am on WHM 11.38.7 right now and SNI is NOT supported

Error message says:

"Your server does not support SNI, so all of your SSL websites must use the same SSL certificate. An update to the certificate on an existing SSL website will affect all of your SSL websites, and new SSL websites must use the currently installed certificate."

Does anyone have a fix? (Or did WHM 11.38.7 not yet include SNI support?)
Thanks

 

[cPanelMichael]

What OS are you using? You can check this with a command such as:

cat /etc/redhat-release

Keep in mind that CentOS 6, RHEL 6, or Cloud Linux 6 is required for native SNI support.

Thank you.

 

[Metro2]

Just ran across this thread as I received a request from a client to add SSL cert to a subdomain for him and I'm checking into options.

I'm running cPanel 11.40.1.8 on Red Hat Enterprise Linux Server release 5.10 (Tikanga) 64 bit and I get the same message as rogerw.

"Your server does not support SNI, so all of your SSL websites must use the same SSL certificate. An update to the certificate on an existing SSL website will affect all of your SSL websites, and new SSL websites must use the currently installed certificate."

Surprisingly I've never been asked about SSL on a subdomain before so I'm just checking into this today and this was the first thread I turned up that looked relevant.

Would SNI make it possible to use the same certificate for a subdomain that is used on the main domain (for instance - if "example.com" has an SSL cert installed, would SNI make it possible for me to use that same cert for "newfolder.example.com" ? )

 

[cPanelMichael]

Would SNI make it possible to use the same certificate for a subdomain that is used on the main domain (for instance - if "example.com" has an SSL cert installed, would SNI make it possible for me to use that same cert for "newfolder.example.com" ? )

No, SNI would allow you to install multiple certificates on a single IP address. RHEL 5 does not support SNI, so you would have to upgrade to RHEL 6 or CentOS 6. You would still need a separate certificate for the subdomain, or a certificate that works for multiple domain names.

Thank you.

 

[Mangoose]

No, SNI would allow you to install multiple certificates on a single IP address. RHEL 5 does not support SNI, so you would have to upgrade to RHEL 6 or CentOS 6. You would still need a separate certificate for the subdomain, or a certificate that works for multiple domain names.

Thank you.

I think if I may the question is " How do you enable SNI support..." . I for instance am not at all helped with this answer. I would like to know HOW TO if you already have WHM 11.444.1 (build 19) running on CENTOS 6.6 x86_64 as your VPS. HOW TO... install multiple SSL's on one IP.
That is what I want to know. The prerequisites are already familiar to me an others by now. Where in WHM / cPanel should I be to make SNI work for me ? What files should I amend and how do I amend them in WHM / cPanel or via SSH terminal command prompt.

 

[cPanelMichael]

Hello

You do not have to enable it, as it's natively supported. You can simply install a SSL certificate for multiple domain names on the same IP address the same way you normally install SSL certificates.

Thank you.

 

[phillbooth]

Hello were you able to do this as I have the exact same problem? thx

 

[cPanelMichael]

Hello were you able to do this as I have the exact same problem? thx

Feel free to let us know if you encounter any problems when attempting to install the certificates.

Thank you.