4

I have seen that with IPv6 you can assign multiple addresses to one interface. I would like to take advantage of that to table able to have specific https certificates associated with a specific address, rather than trying to use one catch-all certificate. Does anyone know how to specify a collection of IP addresses to bind to an interface, on Linux (Ubuntu)?

I will be using Nginx, so it can bind to an IP address when specifying a virtual host.

BTW The clients visiting the services I am setting up are IPv6 enabled, so I am not worried about not getting any IPv4 based connections.

  • You'll need to add information on your server operating system. Ie is it redhat style ie centos/redhat/fedora. Or Debian style (Debian, Ubuntu etc). I can provide an answer if it's redhat style system but not for the other styles – Chunko Feb 24 '17 at 0:58
  • Have added. It is Ubuntu. – Andre M Feb 24 '17 at 1:39
3

You have not needed an IP address per certificate for years now. It indeed used to be true you needed an IP per certificate a decade ago.

About catch-all certificates, most of the public CAs discourage their use, and often will refuse to issue them.

As far as I know ngINX supports SNI (Server Name Indication), and as such, as long ngINX is compiled with SNI support (by default nowadays), it is a matter of configuring several (SSL) vhosts.

The point of SNI is also not having to create a multi-host cert. You create a different certificate for each vhost. So vhost www.example1.com is pointing to the certificate of www.example1.com and the vhost of www.example2.com is pointing to a different certificate that only contains www.example2.com.

From How To Set Up Multiple SSL Certificates on One IP with Nginx on Ubuntu 12.04

About SNI

Although hosting several sites on a single virtual private server is not a challenge with the use of virtual hosts, providing separate SSL certificates for each site traditionally required separate IP addresses. The process has recently been simplified through the use of Server Name Indication (SNI), which sends a site visitor the certificate that matches the requested server name.

  • 1
    This does not answer the question. – Johan Myréen Feb 23 '17 at 6:44
  • 1
    The infered question is the OP thinking it needs to have an IP address per certificate, and thinking it has to use catch all certificates otherwise. However only the OP can clarify that. – Rui F Ribeiro Feb 23 '17 at 8:38
  • Indeed I was trying to avoid trying to a have multi host certificate, and this solution can also be applied to IPv4, though it would still be useful to know how to specify multiple IPv6 addresses on one interface. – Andre M Feb 23 '17 at 16:49
  • added to the answer. The point of SNI is not having to have multiple IP addresses AND not having to create multi host certs. – Rui F Ribeiro Feb 23 '17 at 16:55
2

Yes, you can assign as many IPv6 addresses you want to an interface (and IPv4 addresses too, in fact). This can be done with the ip program (e.g. sudo ip addr add 2001:db8:1:2::1/64 dev eth0). This is roughly equivalent to having many interfaces with one address each, except that the traffic goes through the same interface. How to make the addresses persistent through reboots depends on the Linux distribution, see the documentation for you distribution.

When configuring the server listening on these addresses you do just as if you had one interface per address.

  • Although it's (now) more expensive to get a large number of public v4 addresses than it is for v6 :-) For intranet/private both are easy. – dave_thompson_085 Feb 23 '17 at 13:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.