Impossible to get websites to use respective SSL certificates

Mac OS 10.10.5

Server 5.0.15

I have a question where the default web site ("Server (SSL) Web site" ") is in conflict with the SSL certificates for my three other SSL sites.

The configuration of my website (Note: server IP is 192.168.1.100)

  • Web Server SSL (all IP addresses) site - cert for domain1.com (work)
  • Domain1.com (192.168.1.10) SSL - cert for domain1.com (work)
  • Domain2.com (192.168.1.20) SSL - cert for domain2.com (cert draws for domain1.com, invalid identity)
  • Domain3.com (192.168.1.30) SSL - cert to domain3.com (cert draws for domain1.com, invalid identity)

My DNS records:

  • Primary area - Domain1.com
    • A: Domain1.com 192.168.1.10
    • NS: Domain1.com
  • Primary area - Domain2.com
    • A: Domain2.com 192.168.1.20
    • NS: Domain2.com
  • Primary area - Domain3.com
    • A: Domain3.com 192.168.1.30
    • NS: Domain3.com
  • Reverse zone - 1.168.192
    • PTR: 192.168.1.10 Domain1.com
    • PTR: 192.168.1.20 Domain2.com
    • PTR: 192.168.1.30 Domain3.com
    • NS: Domain1.com
    • NS: Domain2.com
    • NS: Domain3.com
  • Reverse zone - 100.1.168.192.in - addr.arpa
    • PTR: 192.168.1.100 server.domain1.com
    • NS: server.domain1.com

Whatever the cert is selected for the default Web site apply to all SSL Web sites. The only way I can force everyone to use their respective certificates is to set the IP address of the Web site to be the same as the IP of the server (in this example 192.168.1.100). It works, but which prevents the work Profile Manager.

I'm 99% sure that I have my DNS configured correctly (right now all a records point to 192.168.1.100 as a temporary solution), but I'm willing to take another look, if someone has a suggestion clearly and concisely. Ideally, each DomainX.com would have an IP de.10.20 et.30.

So how can I do all three Web sites use different IP addresses AND their respective certificates? Is this possible?

(I appreciate any suggestion at this stage. This question is impossible to find an answer anywhere on the internet after about 9 months of research).

Solution for someone who comes looking for this problem!

After talking to the Apple Enterprise support:

The site services will assuming that you only have one certificate for all Web sites. Unless you want to really roll up your sleeves and get down and dirty with the Apache configuration files, you must have a valid certificate for all areas, you use AND give each site its own IP address.

When configure you your certificate, the host name must look like this:

Server.Domain1.com (this is the name of your common)

*. Domain1.com

*. Domain2.com, etc..

I used a StartCom certificate class 2 IV SSL ($ 59 / year).

Then, assuming you know how to import a verified certificate, use it for all services that need and all the websites you want course (why wouldn't you use https, anyway?)

Tags: Servers and Enterprise Software

Similar Questions

  • You can use cipher suites different use different SSL certificates?

    Using JSSE for SSL, so firstly do javax.net.ssl.SSLContext.init () where you specify as the [KeyManagers]. Here I specify an X509KeyManager where I specify the list of the X 509 certificates I would like to use all by SSL communication with a peer SSL. I'm then a SSLSocket context using SSLContext.getSocketFactory.createSocket () where the created SSL socket use the KeyManager created in the previous step.

    However, when I use this plug to negotiate SSL, I have not any control that cert is used with which cipher suite is chosen during the SSL handshake. For example, if I have two certificates in KeyManager, say A and B, I might want to use one during the continuation of encryption in SSL negotiation is TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA although I could use B when the cipher suite TLS_RSA_WITH_AES_128_CBC_SHA (the cipher suites are according to RFC 5264 for TLS 1.2).

    Is it possible to have this kind of control while using the JSSE in Java?

    I might want to use A only when chosen to negotiate SSL encryption suite is...

    You can not. The encryption suite is chosen after the certificate.

    I don't really see what the choice of the certificate must make the choice of cipher suites. One is for authentication; the other is for encryption.

  • Get error when using charles

    Hi all

    I learn the FCS and when I use Charles to see what is happening in the transactions, I get errors:

    #THROWING ERROR # URLLoader onError. Error. : [IOErrorEvent type = "ioError" bubbles = false cancelable = false eventPhase = 2 text = "Error #2032: stream error."] ["URL: http://connectnow.acrobat.com/XXXX/room2?glt=g%3A & x = 0% 2E6759106982499361 & mode = xml'] >
    INVALID_INSTANCE: Invalid Instance
    at com.adobe.rtc.session.managers::SessionManagerBase/receiveError() [C:\work\main\connect\co comoPlayer10\src\com\adobe\rtc\session\managers\SessionManagerBase.as:270]
    at com.adobe.rtc.session.managers::SessionManagerFMS/receiveError() [C:\work\main\connect\coc omoPlayer10\src\com\adobe\rtc\session\managers\SessionManagerFMS.as:288]
    at com.adobe.rtc.session.managers::SessionManagerAdobeHostedServices/receiveError() [C:\work\ main\connect\cocomoPlayer10\src\com\adobe\rtc\session\managers\SessionManagerAdobeHostedSe rvices.as:254]
    at com.adobe.rtc.session.managers::SessionManagerAdobeHostedServices/onMeetingError() [C:\wor k\main\connect\cocomoPlayer10\src\com\adobe\rtc\session\managers\SessionManagerAdobeHosted Services.as:93]
    at flash.events::EventDispatcher/dispatchEventFunction()
    at flash.events::EventDispatcher/dispatchEvent()
    at com.adobe.rtc.session.sessionClasses::MeetingInfoService/onError() [C:\work\main\connect\c ocomoPlayer10\src\com\adobe\rtc\session\sessionClasses\MeetingInfoService.as:347]
    at flash.events::EventDispatcher/dispatchEventFunction()
    at flash.events::EventDispatcher/dispatchEvent()
    at flash.net::URLLoader/onComplete()


    Everyone gets these errors, and if so what do you use instead of Charles?

    Thank you

    timgerr

    Charles generates it is on certificates for each site. That's why you have put in custody and other issues during the test content on SSL w / Charles. The developer has addressed this issue by creating certificates for each browser to accept the certificate of Charles. It cannot solve the problems in the original post, but it will be ceartinly resolution of issues tests sites over SSL w / Charles in general. Refer to the directions below from the Director:

    http://www.charlesproxy.com/documentation/using-Charles/SSL-certificates/

  • What everyone uses for an SSL certificate on the wireless controller?

    If I use the SSL certificate generated locally on my WLC Internet Explorer always shows the "untrusted cert alert" when users try to authenticate through the web interface. What can I do to fix this do I need to buy a cert? If so where is the best and the best place to do this? GoDaddy? Also, I bought one for my mail server and had set a domain during the process name. What should I use for my WLC? The URL during the authentication process web show https://1.1.1.1

    RapidSSL is your best bet. It is less than $90 for 1 year with renewal and insurance. 5 years is like $ 380. GoDaddy will not work because they use chained certificates.

    On the VIP, you enter the DNS domain name as what you used on the certificate CN when generating a csr. Of course, you have to solve the CN name to 1.1.1.1 or change the 1.1.1.1 to another ip address that is not on your network. Restart the wlc and your done.

  • Cisco ACS 5.4 Support Wildcard SSL certificates?

    Greetings,

    Is getting ready to order a SSL certificate for my ACS 5.4 newly installed, and before I did that I want to check if 5.4 ACS supports Wildcard SSL.

    Someone help me with this?

    Thank you!!!

    Chris B.

    Hi Chris,

    ACS 5.4 still does not support wildcard certificates.

    Regrads

    Anubhav Gupta

  • SSL certificate for the Security Server external facing

    Dear all,

    Today, I bought an external SSL certificate of DigitCert for our security server. I imported the certificates in the personal certificate (computer account) on the Security Server store. DigiCert provided three certificates, root CA, CA server and the other with the name of our domain. I renamed the vdm to the friendly name of the existing self-signed certificate and used the friendly name for the certificate vdm has our domain name. Subsequently, I rebooted consulting on the Security server. They are all released on except the "Display Blast Secure Gateway" service which entered the suspended state.

    On our facility, we have a connection to the server and a security server. To the Security Server, we use a different domain name for connecting to the server. We have an internal PKI and the connection to the server uses an SSL certificate.

    connection to the server = server01.internaldomain.com

    Security Server = server02.externaldomain.com

    Why the certificate cannot be loaded to view Blast Secure Gateway? I missed something?

    Thank you

    Edy

    I solved it. It was with the private key of the certificate. This is the reason that the Blast Secure Gateway could not load.

  • See 4.5 Security server problems since installing SSL certificate

    I'm having some very strange problems with my view view connection Server 4.5 (front and back) running. I hope someone could shed some light on the problem, because I have tried everything I know to do this job properly.

    Before installing a certificate self-signed server of external connection again, I was running the default VMware certificate. Everything worked very well in this configuration. I installed a new self-signed certificate and now I'm having intermittent problems, the connection to the server:

    1. in the connection from a windows machine I CAN reach the site URL/HTTP to download the client from the view. Once I run the client to view I got the following error: failed connection to connect to the server view. Network error.

    2. I tried to connect via the IP address of the server, ensure that the external URL is correct (everything worked fine before the installation of the SSL certificate).

    3. completely removed security server and reinstalled, restart the services etc. Still not connect on some machines. Connecting from a Wyse compatible iPad still works, never a problem.

    4. If I connect the VPN of the company on the machine that does not work, then launches the Client to view and connect everything works as it should. When I disconnect the VPN and try to connect again, I can connect very well! So I need to connect to the VPN to connect to browse... its really weird. I checked DNS etc and everything is identical with the default certificate. I did so that machines that have problems approve the certificate and I also followed the Cisco ASA firewall logs, I do not see happneing anything different between periods of work and does not.

    Someone at - he never lived something along these lines or can think of anything I can try?

    Thank you!

    I came across this same thing.  The conflict is between the customer to view and your new self-signed SSL certificate.  More precisely the thing causing the problem is the version of the wininet.dll file provided with IE8.  The wininet.dll file provided with IE8 causes some kind of conflict with the customer view 4.5 (if using other SSL certificate that the server generated one) and will not allow the client to view 4.5 software to connect to your server security.  I reported this to VMware (2 weeks ago) so that they should be aware of the problem.

    If you remove your new SSL certificate and return to the one created by the display server then everything works perfectly again.  If you are using a machine with IE6 or IE7 XP remove IE8, it also works very well.  I tried taking the file wininet.dll from XP SP3 IE6 machine and restore this file after installing IE8 and everything seemed to work ok, but probably not the best solution.

    Bottom line is until VMware resolves the conflict with their client to view, you may not use any SSL certificate (other than that of the server is) If you are going to connect to windows machines running IE8 or newer.

  • How can I get Firefox re - check the websites ssl certificate? It gives me a message saying that my site's ssl certificate is expired at the time where it is not.

    My side ssl certificate has expired, but it was renewed a few days later. For more than a month it was renewed, but I still have Firefox users, the error of statement.

    This connection is Untrusted
    Technical details:
    Eng.fanpageengine.com uses an invalid security certificate.
    The certificate expired on 31/01/2013 15:59.

    This is a link to a 3rd party site that verifies that the ssl certificate is current.
    http://www.Networking4all.com/en/support/tools/site+check/report/?FQDN=HTTPS%3A%2f%2Feng.fanpageengine.com & Protocol = https

    I need the steps they will need to do Firefix update of its registration.

    Additional information.
    This isn't the effect everyone visiting my website using Firefox. It does seem that effect people who visited the site, although the ssl certificate has expired. However the clearing the cache and cookies have no effect.

    Thanks for the help.

    Thanks for all the help. I found a solution. =)

    https://support.Mozilla.org/en-us/KB/reset-Firefox-easily-fix-most-problems

  • Update for the application manager has failed. Impossible to reinstall. Cannot use my apps. Get the 43 error message when I try to re - install. Is it possible to fix this problem without a wipe and load?

    Update for the application manager has failed. Impossible to reinstall. Cannot use my apps. Get the 43 error message when I try to re - install. Is it possible to fix this problem without a wipe and load?

    Error 43 https://forums.adobe.com/thread/2070909

  • Just downloaded latest updates Camera Raw update for use with my new Sony RX100 M3 but still impossible to get the RAW files to open it. Any suggestions?

    Just downloaded latest updates Camera Raw update for use with my new Sony RX100 M3 but still impossible to get the RAW files to open it. Any suggestions?

    Nevermind, I finally got it to work, thanks!

  • Satellite U500-176: Impossible to get an HDMI output to work on television or monitor

    Hello

    I have a new Satellite U500-176 but impossible to get the HDMI to work on a TV or monitor.

    Usually, when the monitor is connected and I press Fn + F5 I get only the 1 option (LCD).
    Occasionally, the HDMI options work but when I select one it goes to the screen and runs successfully for a few seconds then automatically returns.

    Any ideas?

    See you soon,.
    Roy.

    Hello

    Hmm, what operating system are you using?
    Was - this operating system preinstalled by Toshiba?

    Please take a look in the BIOS. There should be HDMI settings. Please check if it is enabled.
    In addition, I would recommend checking the graphics card driver update.

    What version of BIOS you are using the most recent?

  • Impossible to get brother printer to run on windows 8 model is MFC 685 - CW... also can't download itunes... Help, please!

    Impossible to get brother printer to run on windows 8 model is MFC 685 - CW... also can't download itunes... Help, please!

    Hi Dominic,

    I understand that you are unable to respond to this thread and created a new thread.

    As restart the print spooler does not solve the problem, please reinstall the printer and then check if that helps.

    Check out the following link to resolve the problem of iTunes.

    http://support.Apple.com/kb/HT3204

    Hope that the information provided is useful.

  • With the help of LR4 with Windows 8 - impossible to get the images to desempilement.

    Using LR4 with Windows 8 - impossible to get the images to desempilement.

    Right click on the picture, select stacking, select Unstack

  • Two-node Rac (11204) Cluster node 1 has failed to stop with error: impossible to get in touch with the loan of cluster service. duty to force stop

    Newly build Production environment (don't use it yet)

    OS: Linux redhat 64-bit 2.6.18

    Cluster version: 11.2.0.4

    This environment clusterware installed last December, we are trying to install oracle RDBMS, so try to first stop the crs.  However on node 1, the v$ asm_diskgroup shows nothing under total_mb /free_mb on diskgroup OCR.  and stop the crs shows: impossible to get in touch with the loan of cluster service.

    Alerts cluster log shows below:

    2014-03-25 03:50:01.429:

    [crsd (8608)] CRS-1013: the location of the OCR in ASM disk group is inaccessible. Details in u00/app/11.2.0.4/grid/log/oprd100/crsd/crsd.log.

    2014-03-25 03:50:01.433:

    [crsd (8608)] CRS - 0804:Cluster Ready Service interrupted due to the Oracle Cluster registry error [PROC-26: error when accessing the physical storage]

    ]. Details at (: CRSD00111 :) in u01/app/11.2.0.4/grid/log/orpd100/crsd/crsd.log.)

    2014-03-25 03:50:02.123:

    [ohasd (12490)] CRS - 2765:Resource 'ora.crsd' failed on the server "orpd100".

    2014-03-25 03:50:03.407:

    [crsd (8623)] CRS-1013: the location of the OCR in ASM disk group is inaccessible. Details in u01/app/11.2.0.4/grid/log/orpd100/crsd/crsd.log.

    2014-03-25 03:50:03.411:

    [crsd (8623)] CRS - 0804:Cluster Ready Service interrupted due to the Oracle Cluster registry error [PROC-26: error when accessing the physical storage]

    The NEWSPAPER of the ASM alerts:

    Wed Mar 25 03:21:49 2014

    WARNING: Waited 15 seconds IO to write to the disk of PST 1 in Group 1.

    WARNING: Waited 15 seconds to write IO to disk of PST 2 in Group 1.

    WARNING: Waited 15 seconds IO to write to the disk of PST 1 in Group 1.

    WARNING: Waited 15 seconds to write IO to disk of PST 2 in Group 1.

    Wed Mar 25 03:21:49 2014

    NOTE: process _b000_ + asm1 initiating (21071) 1.1807368888 disk offline (OCR_0681_2EF4) with mask 0x7e in Group 1

    NOTE: process _b000_ + asm1 initiating (21071) 2.1807368889 disk offline (OCR_0681_2EF5) with mask 0x7e in Group 1

    NOTE: check PST: grp = 1

    GMON seeking ways of disc for Group 1 to 5 pid 27, DiSo 21071

    ERROR: read no quorum within Group: required 2 found 1 records

    NOTE: audit PST grp 1 fact.

    NOTE: start the PST update: grp = 1, dsk = 1/0x6bba42b8, mask is 0x6a, op = clear

    NOTE: start the PST update: grp = 1, = 2/0x6bba42b9 dsk, mask is 0x6a, op = clear

    GMON update modes of disk for the Group 1 to 6 for 27, DiSo 21071 pid

    ERROR: read no quorum within Group: required 2 found 1 records

    Wed Mar 25 03:21:49 2014

    NOTE: disassembly of the cache (not clean) Group 1/0x35AAB27B (OCR_DATA)

    WARNING: For disk offline OCR_0681_2EF4 0x7f mode failed.

    2 node rac cluster is normal.  We were able to stop the crs without force.

    What should I look at to understand what is happening here?

    Thanks to adavnace.

    WARNING: For disk offline OCR_0681_2EF5 0x7f mode failed.

    NOTE: e-mail CKPT suspend pins Unix process pid: 21073, image:

    No default value is 1 M

  • Impossible to get anything Ive photoshopped with 14 elements Adobe to shoot and print at Wal-Mart kiosk

    Impossible to get anything I photo shopped with Adobe Elements at a Wal-Mart / Walgreens. Never had a problem with the photos, saving and printing with Corel Photshop

    File > save under of the editor and use the drop-down list to change the file type.

Maybe you are looking for