Server Name Indication, commonly known as SNI, is a TLS extension that allows multiple SSL-enabled websites to run on the same IP address and port. Without SNI, each HTTPS website normally required a dedicated IP address because the web server had to select the SSL certificate before knowing which domain the visitor requested.<\/p>\n\n\n\n
With SNI, the client sends the requested hostname during the TLS handshake. Apache can then select the correct SSL certificate for that domain. This makes it possible to host multiple secure websites on a shared hosting server without assigning a dedicated IP address to every domain.<\/p>\n\n\n\n
Older guides used Before starting, make sure you have:<\/p>\n\n\n\n Example domains used in this guide:<\/p>\n\n\n\n Both domains will use the same server IP address.<\/p>\n\n\n\n For older systems:<\/p>\n\n\n\n Create separate document roots for each domain.<\/p>\n\n\n\n Create test index files.<\/p>\n\n\n\n Set proper ownership.<\/p>\n\n\n\n Each domain must have its own SSL certificate and private key.<\/p>\n\n\n\n Example certificate paths:<\/p>\n\n\n\n The certificate Common Name or Subject Alternative Name should match the domain name.<\/p>\n\n\n\n For production, use a trusted SSL certificate from a Certificate Authority or Let\u2019s Encrypt.<\/p>\n\n\n\n Create a virtual host configuration file.<\/p>\n\n\n\n Add the following configuration:<\/p>\n\n\n\n For Ubuntu \/ Debian, log paths can be changed like this:<\/p>\n\n\n\n For Ubuntu \/ Debian systems, enable the new SSL virtual host file:<\/p>\n\n\n\n For RHEL-based systems, files inside Before restarting Apache, check the configuration syntax.<\/p>\n\n\n\n Expected output:<\/p>\n\n\n\n Open the domains in a browser:<\/p>\n\n\n\n Each domain should load its own website and show its own SSL certificate.<\/p>\n\n\n\n You can also test using OpenSSL:<\/p>\n\n\n\n Check the certificate details in the output. The certificate shown should match the domain passed in the The first SSL virtual host acts as the default virtual host. If an old browser or client does not support SNI, Apache may return the certificate from the first virtual host.<\/p>\n\n\n\n For modern browsers and operating systems, SNI is supported by default.<\/p>\n\n\n\nmod_gnutls<\/code> for SNI support. In modern Apache installations, this is no longer required. Apache with mod_ssl<\/code> supports SNI, so the recommended method is to configure name-based SSL virtual hosts using mod_ssl<\/code>.<\/p>\n\n\n\nPrerequisites<\/h2>\n\n\n\n
\n
mod_ssl<\/code> enabled.<\/li>\n\n\n\nv1.example.org\nv2.example.org\n<\/pre>\n\n\n\n
Step 1: Install Apache SSL Module<\/h2>\n\n\n\n
RHEL \/ CentOS \/ AlmaLinux \/ Rocky Linux<\/h3>\n\n\n\n
sudo dnf install httpd mod_ssl -y\nsudo systemctl enable --now httpd\n<\/pre>\n\n\n\n
sudo yum install httpd mod_ssl -y\nsudo systemctl enable --now httpd\n<\/pre>\n\n\n\n
Ubuntu \/ Debian<\/h3>\n\n\n\n
sudo apt update\nsudo apt install apache2 openssl -y\nsudo a2enmod ssl\nsudo systemctl restart apache2\n<\/pre>\n\n\n\n
Step 2: Create Document Root Directories<\/h2>\n\n\n\n
sudo mkdir -p \/var\/www\/v1\/public_html\nsudo mkdir -p \/var\/www\/v2\/public_html\n<\/pre>\n\n\n\n
echo \"Welcome to v1.example.org\" | sudo tee \/var\/www\/v1\/public_html\/index.html\necho \"Welcome to v2.example.org\" | sudo tee \/var\/www\/v2\/public_html\/index.html\n<\/pre>\n\n\n\n
RHEL-based systems<\/h3>\n\n\n\n
sudo chown -R apache:apache \/var\/www\/v1 \/var\/www\/v2\n<\/pre>\n\n\n\n
Ubuntu \/ Debian<\/h3>\n\n\n\n
sudo chown -R www-data:www-data \/var\/www\/v1 \/var\/www\/v2\n<\/pre>\n\n\n\n
Step 3: Place SSL Certificates<\/h2>\n\n\n\n
\/etc\/ssl\/certs\/v1.example.org.crt\n\/etc\/ssl\/private\/v1.example.org.key\n\n\/etc\/ssl\/certs\/v2.example.org.crt\n\/etc\/ssl\/private\/v2.example.org.key\n<\/pre>\n\n\n\n
Step 4: Configure Apache SSL Virtual Hosts<\/h2>\n\n\n\n
RHEL \/ CentOS<\/h3>\n\n\n\n
sudo vi \/etc\/httpd\/conf.d\/ssl-vhosts.conf\n<\/pre>\n\n\n\n
Ubuntu \/ Debian<\/h3>\n\n\n\n
sudo vi \/etc\/apache2\/sites-available\/ssl-vhosts.conf\n<\/pre>\n\n\n\n
<VirtualHost *:443>\n ServerName v1.example.org\n DocumentRoot \/var\/www\/v1\/public_html\n\n SSLEngine on\n SSLCertificateFile \/etc\/ssl\/certs\/v1.example.org.crt\n SSLCertificateKeyFile \/etc\/ssl\/private\/v1.example.org.key\n\n ErrorLog \/var\/log\/httpd\/v1_ssl_error.log\n CustomLog \/var\/log\/httpd\/v1_ssl_access.log combined\n<\/VirtualHost>\n\n<VirtualHost *:443>\n ServerName v2.example.org\n DocumentRoot \/var\/www\/v2\/public_html\n\n SSLEngine on\n SSLCertificateFile \/etc\/ssl\/certs\/v2.example.org.crt\n SSLCertificateKeyFile \/etc\/ssl\/private\/v2.example.org.key\n\n ErrorLog \/var\/log\/httpd\/v2_ssl_error.log\n CustomLog \/var\/log\/httpd\/v2_ssl_access.log combined\n<\/VirtualHost>\n<\/pre>\n\n\n\n
ErrorLog ${APACHE_LOG_DIR}\/v1_ssl_error.log\nCustomLog ${APACHE_LOG_DIR}\/v1_ssl_access.log combined\n<\/pre>\n\n\n\nStep 5: Enable the Site on Ubuntu \/ Debian<\/h2>\n\n\n\n
sudo a2ensite ssl-vhosts.conf\nsudo systemctl reload apache2\n<\/pre>\n\n\n\n
\/etc\/httpd\/conf.d\/<\/code> are loaded automatically.<\/p>\n\n\n\nStep 6: Test Apache Configuration<\/h2>\n\n\n\n
RHEL \/ CentOS<\/h3>\n\n\n\n
sudo apachectl configtest\nsudo systemctl restart httpd\n<\/pre>\n\n\n\n
Ubuntu \/ Debian<\/h3>\n\n\n\n
sudo apache2ctl configtest\nsudo systemctl restart apache2\n<\/pre>\n\n\n\n
Syntax OK\n<\/pre>\n\n\n\n
Step 7: Test SNI<\/h2>\n\n\n\n
https:\/\/v1.example.org\nhttps:\/\/v2.example.org\n<\/pre>\n\n\n\n
openssl s_client -connect SERVER_IP:443 -servername v1.example.org\n<\/pre>\n\n\n\n
openssl s_client -connect SERVER_IP:443 -servername v2.example.org\n<\/pre>\n\n\n\n
-servername<\/code> option.<\/p>\n\n\n\nImportant Notes<\/h2>\n\n\n\n