create ssl cert per vhost, not one monster #2129
Conversation
evgeni
force-pushed
the
split-https
branch
2 times, most recently
from
2f6f03b
to
e86d51f
Compare
There was a problem hiding this comment.
tl;dr: 👍 on the concept, some implementation notes inline.
I recently read there's some benefit in having all names on a certificate so browsers can reuse connections, but given we're mostly behind a CDN I think the benefit of that is really limited and the operational simplicity of one cert per vhost is way more important.
In the installer we use datacat to gather all values so you could do it that way per host, but it's complex. Also, the module is unmaintained and collections is a maintained alternative.
|
This solution works for me as an approach. Thanks for taking a look. |
|
finally updated! |
There was a problem hiding this comment.
Looks like we could migrate this to using web::vhost as well after this change.
https://webmasters.stackexchange.com/questions/97005/setting-x-forwarded-proto-under-apache-2-4 suggests you can also use RequestHeader set X-Forwarded-Proto expr=%{REQUEST_SCHEME} to make it dynamic, meaning it's going to be the same directive for HTTP and HTTPS.
I can submit a follow up PR to do so.
No description provided.