Re: [squid-users] Squid Multiple SSL sites and Single IP solution

Hey Jesse,

 From what I understood SNI is not fully supported by all browsers yet.
If you need the private key of the root CA to sign a certificate this is
very bad for anything in CA's world.

The idea as far I know to use a signed certificate which will provide
everything needed to validate and encrypt the needed data.

I have never used SNI but I heard about it.
I assume that if it's part of openssl it just means that it's good and
secure.

Many providers use wildcard certificate which for example akamai and
Amazon offers\use.

I think that less about the need for that option there is a need to
encourage using more of the resources you have.

For now if there is a need for SNI nginx can provide the SSL part.

I was interested in comparison of nginx vs squid in the cache angle.
I know that squid "persistent" cache is better then nginx since nginx is
not really 100% committed to be "cache" but more like a web server.
It wont save headers and there for the response will be different while
fetched from source and served from cache(persistent).

Regards,
Eliezer

On 11/5/2012 4:27 PM, Jesse Smith wrote:
> Hello everyone, thought i'd share our recent endeavor about getting
> Squid to work with multiple SSL domains (single set of certs and one IP).
>
> We were able to get that working, but didn't do us much good as we had
> to be our own Root CA. We didn't want to have to have the users download
> our cert into their browser, just to use our site. In other words,
> everything was to remain transparent.
>
> It is impossible to use a Root CA (Commercial like Verisign), because
> you would have to have their private key to sign the generated certs.
>
> Our solution was to use the Nginx web server, which supports multiple
> SSL domains using a single IP. The server also acts as a reverse proxy.
> Nginx uses SNI to get this configuration working.
>
> I only mention this as Squid should do the same and potentially make it
> a priority as places are looking for this kind of configuration
> increasingly.
>
> Anyway, that's the story ... thanks for reading and hope it will provide
> more insight to your own situation if using multiple SSL domains hosted
> by a single IP.
>
> Thanks

-- 
Eliezer Croitoru
https://www1.ngtech.co.il
IT consulting for Nonprofit organizations
eliezer <at> ngtech.co.il