FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Intermediate

Can I serve different certificates for different domains on the same IP:443 (SNI)? ​

Short answer

Yes, thanks to SNI. In the TLS handshake, the client sends the domain it wants to connect to (SNI), and TR7 serves the certificate that matches it. There are two ways: more than one certificate is selected in the Certificate field of a single vService; or each domain becomes a separate vService with Virtual Hosting, and each one uses its own certificate. The difference shows in unmatched requests: in a single vService, if there is no certificate that matches the SNI, the first certificate in the list is served; in Virtual Hosting, the connection is closed. In both ways, the certificates are first uploaded under SSL/TLS Certificates.

Problem: Which Certificate Is Served on a Single IP? ​

The TLS handshake takes place before the HTTP request; when selecting the certificate, the server does not yet see the Host header of the request. If more than one domain is published on a single IP:443, which certificate is served is determined by the SNI information the client sends in the handshake. If there is no certificate that matches the SNI, the browser shows a certificate warning.

Solution: Two Methods ​

Your situationSuitable method
The domains go to the same application and the same settingsMethod 1: Single vService, multiple certificates
Each domain is a separate site; its settings and Backend Services are differentMethod 2: Virtual Hosting
  • How it works TR7 compares the client's SNI with the domains (CN/SAN) of the selected certificates and serves the matching one. If there is no match, the first certificate in the list is served.
  • Where it is opened vService → Certificate (multiple selection)
  • Requirement The certificates must have been uploaded under Certificates & PKI beforehand; the frontend protocol must be Encrypted (HTTPS)
  • vService type HTTP

Step-by-Step Configuration ​

1
Adım 1 Open the certificate form and enter the certificate

The Certificates & PKI → SSL/TLS Certificates → Add steps are followed; the certificate is given a name and the certificate of the domain is entered.

2
Adım 2 Save the certificate

The Add button is clicked. Steps 1–2 are repeated for the certificate of each domain.

3
Adım 3 Open the vService

The Load Balancer → Load Balancer vService List steps are followed and the HTTP vService is opened; in the Protocol field of the 443 row, a protocol from the Encrypted (HTTPS) group is selected.

4
Adım 4 Select the certificates

In the Certificate field, the certificates of all the domains are selected. The certificates are listed in the order in which they are selected; clients that do not send SNI or that match no certificate are served the first certificate in the list, so the certificate intended to be the default is selected first.

5
Adım 5 Save

The Save button is clicked.

Verification ​

1Certificate with SNIClient side
Commandopenssl s_client -connect 203.0.113.10:443 -servername b.example.com </dev/null | openssl x509 -noout -subject
Expectedsubject=CN = b.example.com
The command is repeated for each domain. When tried without SNI using -noservername, the first certificate in the list is returned.

Method 2: Virtual Hosting ​

  • How it works For a connection arriving at the shared IP:port, TR7 selects the vService according to the SNI; that vService terminates TLS with its own certificate.
  • Where it is opened Each vService → Virtual Hosting + Certificate
  • Requirement The Virtual Hosting list must be filled in all the vServices that share the IP:port
  • vService type HTTP

Step-by-Step Configuration ​

1
Adım 1 Prepare the vService for each site

For each domain, an HTTP vService is created that uses the same IP:443 and a protocol from the Encrypted (HTTPS) group (if the shared IP is not in the list, it is first added to the interface with + Add IP); Virtual Hosting is turned on and the domain is written.

2
Adım 2 Select its own certificate for each vService

In the Certificate field of each vService, the certificate of that domain is selected. The certificates are uploaded beforehand with Certificates & PKI → SSL/TLS Certificates → Add, as in step 1 of Method 1.

3
Adım 3 Save

The Save button is clicked in each vService.

Verification ​

1Request by domain nameClient side
Commandcurl -v --resolve b.example.com:443:203.0.113.10 https://b.example.com/
ExpectedThe certificate and site of b.example.com

Common Mistakes ​

  • Selecting HTTPS as the protocol without selecting a certificate. Saving is not prevented, but the port listens as unencrypted HTTP.
  • Not considering the order of the default certificate (Method 1). Clients without SNI or that do not match are served the first certificate in the list; these clients see a certificate warning.
  • Testing the same IP with the IP address. A client that connects with the IP does not send SNI; in Method 1 the first certificate is returned, in Method 2 the connection is closed.
  • Expecting HTTP/3 in Virtual Hosting. HTTP/3 is not served on a vService whose Virtual Hosting list is filled.

How it is done in the documentation

Related questions