Aug 22, 2016

Multiple SSL on same IP

There is a known web server limits, make it hard to host many SSL on same server with only 1 IP address. (see http://nginx.org/en/docs/http/configuring_https_servers.html )

An SSL certificate with several names seems to be the simplest solution. Here is outline of 1 way to do it:
* Automate using https://github.com/srvrco/getssl to get certificates
* Let's encrypt with 1 main domain, other domains consider as alternative names

Steps
1. Initialize configurations: getssl -c MAIN.DOMAIN

2. Change CA to production, ACCOUNT_EMAIL in ~/.getssl/getssl.cfg

3. Enter SANS, ACL,RELOAD_CMD in ~/.getssl/MAIN.DOMAIN/getssl.cfg

ACL is path (public accessible via URL) to verify your domains.
it must have same number of lines as number of your domains.

RELOAD_CMD can be 
sudo nginx -s reload
Let's current user is deploy. visudo to allow: 
deploy ALL=NOPASSWD:/usr/sbin/nginx

4. Get certificates: getssl MAIN.DOMAIN
5. Configure nginx to use certificates in ~/.getssl/MAIN.DOMAIN
6. Automate renew using cron 

23  5 * * * /home/deploy/scripts/getssl -u -a -q