SSL SNI Issue

[LimeCanvasWil]

Hi there,

Just found this thread and I'm having the same problem.
http://forums.cpanel.net/f5/ssl-sni-problem-366961.html

I'm running CentOS 6.5 x86_64 kvm and WHM 11.42.0 (build 23)

I understand that SSL SNI should be working on this combo, however, I'm getting the same issue as the thread author.

I have one VPS with shared IPs for all accounts.

Two of the accounts have SSL certs bound to their domains and operate correctly.

However, when anyone tries to view the other domains (non SSL certs) on the VPS, over HTTPS, it redirects to the same secure version of one of the domains with a SSL cert.

I contacted the host provider and they think it's an issue with SNI on WHM and suggested contacting yourselves (or getting unique IPs for each SSL cert domain).

Can anyone point me in the right direction in resolving this?

Thanks,
Wil.

 

[cPanelMichael]

Hello

The issue you have reported is not similar to the thread that you referenced. As I understand, you are able to successfully install SSL certificates on the shared IP addresses. What you are noticing is the intended behavior. The primary certificate is the default certificate for an IP address. Thus, all secure requests over the IP address itself, and over domain names without a certificate configured will use the primary certificate. You can make a certificate the primary one via "WHM Home » SSL/TLS » Manage SSL Hosts". Or, you can install a SSL certificate for each domain name on that IP address.

Thank you.

 

[LimeCanvasWil]

Hi Michael,

Ah yes, sorry I must have pasted in the wrong link. I was looking at so many threads trying to see if somebody else had the same issue.

So is there no way to have a mixture of cert and non cert domains on the same shared IP without redirecting to the primary cert for non-cert domains?

Or to clarify, are my only options:
1. Purchase an IP for the cert domains?
2. Purchase a cert for the non cert domains?

Many thanks,
Wil.

 

[cPanelMichael]

Or to clarify, are my only options:
1. Purchase an IP for the cert domains?
2. Purchase a cert for the non cert domains?

Yes, these are the two options available to see a change in the behavior you have reported. Note that you could use a self-signed certificate if you do not want to purchase a certificate for the domain names without existing SSL certificates.

Thank you.