Forum OpenACS Q&A: Re: OpenSSL, Host-Node Map and Subsites

My e-mail to Scott Goodwin (nsopenssl author):

OpenACS allows you to create subsites under the main site so that you can run multiple sites from the same code and database. For example:

• Main Site: http://www.mainsite.com/
• Subsite: http://www.mainsite.com/my-subsite/

With the OpenACS host-node-map utility, you can map any hostname to the subsite, hiding its relation to the main site. For example:

You could map

• http://www.my-subsite.com/

...to...

• http://www.mainsite.com/my-subsite/

...where www.my-subsite.com and www.mainsite.com point to the same IP.

We are trying to determine the best way to enable SSL on subsites that use mapped hosts since each subsite/host will need its own certificate.

I was hoping nsopenssl 3.x would allow you to set up multiple drivers for an nsd so that you could use a the same IP address and port with a separate sslcontext and hostname. But, when I tested that, it didn't work in that it always used the last driver specified in the AOLserver config file.

Scott Goodwin's response:

Unfortunately, this isn't possible and it has to do with the SSL spec. When a client connects, the first thing that happens is the SSL handshake. Your server doesn't even know what URL, and hence, which subsite the connection is destined for until after the SSL handshake is done.

The only way to do what you want is to add multiple IP addresses to your ethernet card and assign each address to a different subsite. This way you can attach a cert on a subsite basis. nsd listens on a different address for each subsite and so knows which cert to use.

Yeah, I was just posting his response here for the archive.

But, since the host-node-map, as I understand it, requires that all hosts point to the same IP, does that mean that SSL cannot be made to work for subsites using the host-node-map functionality?

If all the hosts were in the form of subsite1.mydomain.com and subsite2.mydomain.com, you could use a wildcard SSL cert, but that will not always be the case.

Ok, so if you must use a proxy, couldn't the proxy also enable you to use SSL with subsites that use separate, disparate domains, such as www.mydomain1.com and www.mydomain2.com (i.e. when a wildcard cert isn't an option)?

For example, would this work...?

1. Pound (or another proxy) handles https handshake for :
  - www.mydomain1.com on external IP 1.2.3.4
  - www.mydomain2.com on external IP 1.2.3.5
2. Internal DNS set up with both domains pointing to same IP:
  - www.mydomain1.com on internal IP 192.168.0.1
  - www.mydomain2.com on internal IP 192.168.0.1
3. AOLserver instance running www.mydomain1.com on 192.168.0.1
4. OpenACS configured to use host-node-map to map:
  - www.mydomain2.com to www.mydomain1.com/mysubsite2/
5. Pound communicates with AOLsever using HTTP, not HTTPS,
  but Pound can tell OpenACS if the external connection is
  secure so OpenACS can enforce the require SSL on
  registration/log in (probably with a little modification to
  the OpenACS code)

I can provide modifications to the request processor to make this transparent to OpenACS.

That would be great. Please let me know when you post the code. Thanks.