Virtual domains and SSL certificates

[Samuel Castro]

Maybe this is covered elsewhere but cannot find another reference.

If you use mixed server, the user enters an http address, he is redirected to the same via https and then back to http to continue mail session. There is a problem the server is in fact a virtual server and the certificate´s common name does not match.

What I want to accomplish is to avoid certificate common name mismatch by redirecting the user to a fixed https server name independently of his original domain name, i.e.:

now

http://mail.customer_a.com -> https://mail.customer_a.com (not good because the ssl certificate common name does not match and the user's browser will cry!) -> http://mail.customer_a.com

proposed

http://mail.customer_a.com -> https://secure.provider.com -> http://mail.customer_a.com

It would be great if this could be done even without breaking the virtual server functionality, maybe by including a hidden field (or a cookie) in the secure auth form so he can redirected back to the his domain.

[iain]

bump...

I'd also like a sensible way to resolve this problem with certificate errors on virtual domains.

[bdial]

would a wildcard cert fix your problem?

that is if you have a few hundred spare dollars to throw at this problem they're nice to have though.

edit: doh i re-read your post and it seems like this wouldn't fix because you're going to completely separate domains sorry

[Bill Brock]

I know that in the past web servers such as Apache required a separate IP address for each virtual domain that had an SSL certificate. I'm not sure how the Jetty server works in ZCS. I have my hosted user logon to the primary domain and login with their full e-mail address. This way the certificate that they see and they site they are hitting match. I also have them set their pop3/smpt clients up to logon to the primary domain.

For IE users I had to e-mail a copy of the CA certificate and had the install the certificate. Windows puts the CA cert into the root store and then the user gets no more certificate errors.