2 SSL using 2 IP Addresses, how?

I use apache vHosts, and it never gave me an error on IE, or XP, not even on a windows 2000 box in my school, and that was serving 8 SSL certs from a single IP..

But yea, 2 IP's is definitely possible and linode staff will allow you if they verify that you are actually hosting SSL sites off it.

@halothe23:

I use apache vHosts, and it never gave me an error on IE, or XP, not even on a windows 2000 box in my school, and that was serving 8 SSL certs from a single IP..
Really? I thought browsers that used Windows APIs on XP (such as IE) were the primary example of setups that lack SNI ability. Was that fixed and I'm now operating on incorrect information?

@markunit:

My thought is, purchasing a second IP address for my server and running this site from this second IP.

Is this possible?
Yes, we do this for our sites with SSL's. We have three currently running on one Linode (along with many non-SSL sites). Each site with an SSL has its own IP address.

How you implement it depends on the distro and the control panel software that you're using.

MSJ

Thanks MSJ,

Once you set the network file and edited the settings for specific IP addresses, did you need to change any other settings to keep http, SSL, and MySQL working? Did you have to hard code the IP in any other files?

Mark,

Your control panel software may make these changes for you (depending on what you're using).

We edited added a ifcfg-eth1 (and 2 and 3) file to the network-scripts folder (RHEL / Red hat / Fedora / CentOS - it's different on Debian / Ubuntu) and updated the vhosts files.

We did not have to do anything to any services (except restart apache after changing things). We did make sure that 443 wasn't blocked in iptables.

We did update out SPF records to allow for the additional IPs as outgoing mail possibilities.

Are you having any issues or are you just trying to do your homework to make sure you don't end up with any unexpected hurdles?

MSJ

Thank you.

Just asking many questions now before starting.

Dont have any control panel installed and will do everything from command line and ftp and don't use email on this server, so hopefully MySQL and other base services will continue to work on all interfaces as they did before?

MSJ, I have 2 sites that will each use its own SSL cert, but also 2 other small sites running on the same server.

How have you setup your Virtual hosts files to point to set IP addresses for some sites but none for other sites?

Mark,

For the sites that share the non-SSL IP we use this at the top of the vhost file:````

For the sites with their own IP & SSL we use these in the vhost file:````
 <virtualhost \="" 555.666.777.888:80\=""></virtualhost> 

& <ifmodule mod_ssl.c=""><virtualhost \="" 555.666.777.888:443\=""></virtualhost></ifmodule>

MSJ

@markunit:

Just asking many questions now before starting … so hopefully MySQL and other base services will continue to work on all interfaces as they did before?
The services should all work fine without any intervention. IIRC we may have had to restart our VPS after adding the network changes so it could access the additional IP we were assigned.

Thanks MSJ,

Currently we have…

site 1….

site 2….

site 3….

site 4….

site1…. SSL

Once we get 2 fixed IPs what would we do with site 3 and 4, would we fix them to any IP?

site 1….

site 2….

site 3….

site 4….

site1…. SSL

site2…. SSL

Mark,

If you have 3 IPs: 1 for each SSL site and then one for the rest you'd want the shared IP in the vhost files for site 3 & 4 and not 1.2.3.4 (which you used in site 1).

I think you need the with the in the same vhosts file for sites 1 & 2 (each with their own IP address).

MSJ

Thanks again MSJ,

Currently I have 1 IP shared among 4 or 5 websites with only 1 have SSL. I will add a second IP giving only 2 in total.

I would like to use them to have 2 sites with SSL, each on a different IP, and the other 3 sites simply sharing port 80 on any of the IPs.

Would my setup shown above for the allow for this where I just put the other 3 sites in any IP, or do you do it differently?

I guess you could have all the non-SSL sites sharing an IP with one SSL site (I've never done that but I don't know that it's a problem). Then you'd have just two IPs.