Solved

Help on configuring multiple Virtual Hosts on the same servers using SSL certificates

Posted on 2010-11-08
3
437 Views
Last Modified: 2013-12-10
I'm running into an issue trying to configure multiple applications on the same physical boxes to be accessed through an SSL connection (https) and could use some fairly detailed help on how to

The issue I am running into is this:

ApplicationA is a web application accessed through a Load Balanced address of https://mw-applicationa-lb.  The load balancer sends traffic to an IHS webserver running on either server1 or server2 (the app is horizontally clustered)  IHS, using the WAS plugin, redirects to the appropriate cluster in WebSphere Application Server (IHS, plugin and AppServer are all on the same server.. server1 and server2)

This basic configuration we have working...

The issue is when we add a 2nd application, ApplicationB in another cluster, responding to a different load balanced address, https://mw-applicationb-lb.

When a user tries to access the second application, they get a pop-up/warning that the certificate is invalid, because they are going to https://mw-applicationb-lb, but the certificate was issued to mw-applicationa-lb  We had thought we could add another certificate to the server for each virtual host, but it doesn't seem to be working.

I'm sure this is a fairly common configuration, but we haven't been able to get rid of this warning.  Anyone have thoughts on what we may be doing wrong?  I'm terribly inexperienced with SSL configurations, so please explain in some detail if you could.

If I need to provide more information, let me know

TIA,
 Brian
0
Comment
Question by:Bbouch
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 8

Accepted Solution

by:
AdminRAM earned 500 total points
ID: 34133621
Hi Brian,


ApplicationA is a web application accessed through a Load Balanced address of https://mw-applicationa-lb.

---> I believe you enabled SSL on Webserver. If so the certificate which shows in browser it will be displayed by webserver.


The issue is when we add a 2nd application, ApplicationB in another cluster, responding to a different load balanced address, https://mw-applicationb-lb.

---> If you using same IHS then you will get a pop-up/warning that the certificate is invalid, because url mw-applicationb-lb you given is not matching the certificate CN (mw-applicationa-lb) displayed by webserver..

Therefore nothing you can do websphere side because certificate is presenting by IHS..

you need to add If you are enabling multiple Web sites for SSL, you can enable SSL as follows. All hostnames must be registered in DNS to a separate IP address. Also, all the IP addresses must be configured on a local network interface card.

more details see the following link

IBM - Guide to properly setting up SSL within the IBM HTTP Server
http://www-01.ibm.com/support/docview.wss?uid=swg21179559

AdminRam
0
 
LVL 1

Author Closing Comment

by:Bbouch
ID: 34160932
Thanks AdminRam. I thought I had read this somewhere, but I wanted to verify I wasn't crazy.  Since we're talking about a few hundred potential addresses, I think we'll reconsider our strategy and go with more generic addresses.
0
 
LVL 8

Expert Comment

by:AdminRAM
ID: 34161502
Thank you very much for grade and points

Have a good day
AdminRam
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Verbose logging is used to diagnose garbage collector problems. By default, -verbose:gc output is written to either native_stderr.log or native_stdout.log.   It is also possible to redirect the logs to a user-specified file. This article will de…
Most of the developers using Tomcat find it easy to configure the datasource in Server.xml and use the JNDI name in the code to get the connection.  So the default connection pool using DBCP (or any other framework) is made available and the life go…

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question