Enabling SNI support for Addon domains using Include Editor

tdubs

Registered
May 7, 2013
3
0
1
cPanel Access Level
Website Owner
Hi CPanel/WHM community,

I have a quick question. I'm trying to secure multiple addon domains that are pointing to one server and one IP address using SNI. While it's not yet supported by CPanel, it is supported by the version of Apache that I am running.

Is it possible to add virtual hosts using the Include Editor for Apache?

I found this guide, Using Multiple SSL Certificates in Apache with One IP Address, but I'm not sure if its as easy as typing...

Code:
<NameVirtualHost *:443>

<VirtualHost *:443>
ServerName www.yoursite.com
DocumentRoot /var/www/site
SSLEngine on
SSLCertificateFile /path/to/www_yoursite_com.crt
SSLCertificateKeyFile /path/to/www_yoursite_com.key
SSLCertificateChainFile /path/to/DigiCertCA.crt
</Virtual Host>

<VirtualHost *:443>
ServerName www.yoursite2.com
DocumentRoot /var/www/site2
SSLEngine on
SSLCertificateFile /path/to/www_yoursite2_com.crt
SSLCertificateKeyFile /path/to/www_yoursite2_com.key
SSLCertificateChainFile /path/to/DigiCertCA.crt
</Virtual Host>
...for my domains.

Is securing multiple domains through SNI even possible using the Include Editor?

- - - Updated - - -

And I should have said:

"I'm not sure if its as easy as typing into the Include Editor box"...
 

tdubs

Registered
May 7, 2013
3
0
1
cPanel Access Level
Website Owner
I'm running WHM 11.36.1 build 5 and cPanel 11 that is optimized for a VPS. My hosting provider said that my version of cPanel does not yet support SNI.

- - - Updated - - -

I've read the docs. Is it as simple as entering the following text into either the Pre or Post VirtualHost? These are just example domains.

Code:
<NameVirtualHost *:443>

<VirtualHost *:443>
 ServerName www.yoursite.com
 DocumentRoot /var/www/site
 SSLEngine on
 SSLCertificateFile /path/to/www_yoursite_com.crt
 SSLCertificateKeyFile /path/to/www_yoursite_com.key
 SSLCertificateChainFile /path/to/DigiCertCA.crt
</Virtual Host>

<VirtualHost *:443>
 ServerName www.yoursite2.com
 DocumentRoot /var/www/site2
 SSLEngine on
 SSLCertificateFile /path/to/www_yoursite2_com.crt
 SSLCertificateKeyFile /path/to/www_yoursite2_com.key
 SSLCertificateChainFile /path/to/DigiCertCA.crt
</Virtual Host>
 

tdubs

Registered
May 7, 2013
3
0
1
cPanel Access Level
Website Owner
I'm not a server administrator, so excuse my naivete, but if Apache supports SNI and WHM + cPanel does not support SNI, then I can still run SNI on the server, I just can't configure and control it from WHM or cPanel, correct?
 

cPanelKenneth

cPanel Development
Staff member
Apr 7, 2006
4,607
80
458
cPanel Access Level
Root Administrator
I'm not a server administrator, so excuse my naivete, but if Apache supports SNI and WHM + cPanel does not support SNI, then I can still run SNI on the server, I just can't configure and control it from WHM or cPanel, correct?
You are correct that you can do things manually to get SNI working. If you have access to the Apache configuration file, that tells me you have root access to the server. I strongly encourage you to upgrade to cPanel & WHM 11.38 to get SNI support. This way you can get SNI working in a method that is compatible with cPanel & WHM, and can be managed using the SSL Management interfaces we provide.

Whether you do this manually, or upgrade to cPanel & WHM 11.38, you will also need to be using CentOS 6, RHEL 6, or CloudLinux 6 for SNI to function. While Apache has long supported SNI, the OpenSSL library has not. The version of the OpenSSL library provided on older versions of CentOS, CloudLinux, and RHEL, do not support SNI.
 

rogerw

Member
Feb 21, 2012
23
6
53
cPanel Access Level
Website Owner
You are correct that you can do things manually to get SNI working. If you have access to the Apache configuration file, that tells me you have root access to the server. I strongly encourage you to upgrade to cPanel & WHM 11.38 to get SNI support. This way you can get SNI working in a method that is compatible with cPanel & WHM, and can be managed using the SSL Management interfaces we provide.

Whether you do this manually, or upgrade to cPanel & WHM 11.38, you will also need to be using CentOS 6, RHEL 6, or CloudLinux 6 for SNI to function. While Apache has long supported SNI, the OpenSSL library has not. The version of the OpenSSL library provided on older versions of CentOS, CloudLinux, and RHEL, do not support SNI.
I am on WHM 11.38.7 right now and SNI is NOT supported

Error message says:

"Your server does not support SNI, so all of your SSL websites must use the same SSL certificate. An update to the certificate on an existing SSL website will affect all of your SSL websites, and new SSL websites must use the currently installed certificate."

Does anyone have a fix? (Or did WHM 11.38.7 not yet include SNI support?)
Thanks
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,880
2,261
463
What OS are you using? You can check this with a command such as:

Code:
cat /etc/redhat-release
Keep in mind that CentOS 6, RHEL 6, or Cloud Linux 6 is required for native SNI support.

Thank you.
 

Metro2

Well-Known Member
May 24, 2006
585
98
178
USA
cPanel Access Level
Root Administrator
Just ran across this thread as I received a request from a client to add SSL cert to a subdomain for him and I'm checking into options.

I'm running cPanel 11.40.1.8 on Red Hat Enterprise Linux Server release 5.10 (Tikanga) 64 bit and I get the same message as rogerw.

"Your server does not support SNI, so all of your SSL websites must use the same SSL certificate. An update to the certificate on an existing SSL website will affect all of your SSL websites, and new SSL websites must use the currently installed certificate."

Surprisingly I've never been asked about SSL on a subdomain before so I'm just checking into this today and this was the first thread I turned up that looked relevant.

Would SNI make it possible to use the same certificate for a subdomain that is used on the main domain (for instance - if "example.com" has an SSL cert installed, would SNI make it possible for me to use that same cert for "newfolder.example.com" ? )
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,880
2,261
463
Would SNI make it possible to use the same certificate for a subdomain that is used on the main domain (for instance - if "example.com" has an SSL cert installed, would SNI make it possible for me to use that same cert for "newfolder.example.com" ? )
No, SNI would allow you to install multiple certificates on a single IP address. RHEL 5 does not support SNI, so you would have to upgrade to RHEL 6 or CentOS 6. You would still need a separate certificate for the subdomain, or a certificate that works for multiple domain names.

Thank you.
 

Mangoose

Active Member
Aug 5, 2014
32
0
6
cPanel Access Level
Root Administrator
No, SNI would allow you to install multiple certificates on a single IP address. RHEL 5 does not support SNI, so you would have to upgrade to RHEL 6 or CentOS 6. You would still need a separate certificate for the subdomain, or a certificate that works for multiple domain names.

Thank you.
I think if I may the question is " How do you enable SNI support..." . I for instance am not at all helped with this answer. I would like to know HOW TO if you already have WHM 11.444.1 (build 19) running on CENTOS 6.6 x86_64 as your VPS. HOW TO... install multiple SSL's on one IP.
That is what I want to know. The prerequisites are already familiar to me an others by now. Where in WHM / cPanel should I be to make SNI work for me ? What files should I amend and how do I amend them in WHM / cPanel or via SSH terminal command prompt.
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,880
2,261
463
Hello :)

You do not have to enable it, as it's natively supported. You can simply install a SSL certificate for multiple domain names on the same IP address the same way you normally install SSL certificates.

Thank you.
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,880
2,261
463
Hello were you able to do this as I have the exact same problem? thx
Feel free to let us know if you encounter any problems when attempting to install the certificates.

Thank you.