介绍
服务器名称指示（SNI）是TLS协议的一项功能，可以在单个IP地址上设置多个SSL证书。 Lighttpd必须已经设置并运行。阅读这些文章，得到它。建立
本教程将使用两个域。两者都将使用自签名SSL证书。 域1：example.com 通用名：* .example.com的 领域二：digitalocean.com 通用名： www.digitalocean.com SSL设置需要默认证书，就像默认的虚拟主机一样。我们将使用第一个域的证书。创建私钥
里面创建一个目录/etc/lighttpd放置密钥和证书。
mkdir /etc/lighttpd/certs
cd /etc/lighttpd/certs
openssl genrsa -des3 -out example.com.key 2048
openssl rsa -in example.com.key -out example.com.key
openssl genrsa -des3 -out digitalocean.com.key 2048
openssl rsa -in digitalocean.com.key -out digitalocean.com.key
创建证书签名请求
为这两个域名创建CSR。cd /etc/lighttpd/certs
openssl req -new -key digitalocean.com.key -out digitalocean.com.csr
openssl req -new -key example.com.key -out example.com.csr
.如果你想离开领域的空白。
-----
Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]:.
Locality Name (eg, city) []:NYC
Organization Name (eg, company) [Internet Widgits Pty Ltd]:DigitalOcean Inc
Organizational Unit Name (eg, section) []:.
Common Name (e.g. server FQDN or YOUR name) []:www.digitalocean.com
Email Address []:webmaster@digitalocean.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
example.com确保输入
*.example.com 。
-----
Country Name (2 letter code) [AU]:IN
State or Province Name (full name) [Some-State]:.
Locality Name (eg, city) []:Chennai
Organization Name (eg, company) [Internet Widgits Pty Ltd]:.
Organizational Unit Name (eg, section) []:.
Common Name (e.g. server FQDN or YOUR name) []:*.example.com
Email Address []:admin@example.com
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
签署您的SSL证书
在这里，我们将设置不同的长度有效性（-days参数）两个证书，使我们可以在它们之间很容易区分。
cd /etc/lighttpd/certs
openssl x509 -req -days 100 -in example.com.csr -signkey example.com.key -out example.com.crt
openssl x509 -req -days 200 -in digitalocean.com.csr -signkey digitalocean.com.key -out digitalocean.com.crt
.pem从证书及其私钥文件。
cat example.com.{key,crt}> example.com.pem
cat digitalocean.com.{key,crt}> digitalocean.com.pem
chmod -R 400 /etc/lighttpd/certs/
为SSL配置Lighttpd
编辑/etc/lighttpd/lighttpd.conf文件，并在末尾添加以下代码行。
$SERVER["socket"] == "0.0.0.0:443" {
ssl.engine = "enable"
ssl.pemfile = "/etc/lighttpd/certs/example.com.pem"
$HTTP["host"] =~ "(^|www\.)digitalocean.com" {
ssl.pemfile = "/etc/lighttpd/certs/digitalocean.com.pem"
}
}
example.com是默认的，我们不把它的主机里面的条件。 重新启动Lighttpd守护程序。
service lighttpd force-reload
.pem文件。
测试HTTPS
测试这个不编辑 hosts文件的简单方法是使用curl 。 该命令有一个
--resolve它映射域名与IP地址的说法。 与Droplet的IP地址替换
1.1.1.1。
curl -k -o /dev/null --resolve "www.digitalocean.com:443:1.1.1.1" -s -v https://www.digitalocean.com
-o会将所有HTML输出，因为我们不需要它。这是我们感兴趣的代码段。
* SSL connection using AES256-SHA
* Server certificate:
* subject: C=US; L=NYC; O=DigitalOcean Inc; CN=www.digitalocean.com; emailAddress=webmaster@digitalocean.com
* start date: 2014-03-26 18:39:25 GMT
* expire date: 2014-10-12 18:39:25 GMT
* common name: www.digitalocean.com (matched)
* issuer: C=US; L=NYC; O=DigitalOcean Inc; CN=www.digitalocean.com; emailAddress=webmaster@digitalocean.com
* SSL certificate verify result: self signed certificate (18), continuing anyway.
curl -k -o /dev/null --resolve "www.example.com:443:1.1.1.1" -s -v https://www.example.com
* SSL connection using AES256-SHA
* Server certificate:
* subject: C=IN; L=Chennai; CN=*.example.com; emailAddress=admin@example.com
* start date: 2014-03-26 18:39:20 GMT
* expire date: 2014-07-04 18:39:20 GMT
* common name: *.example.com (matched)
* issuer: C=IN; L=Chennai; CN=*.example.com; emailAddress=admin@example.com
* SSL certificate verify result: self signed certificate (18), continuing anyway.
user@droplet~$ curl -k -o /dev/null -s -v https://1.1.1.1
* SSL connection using AES256-SHA
* Server certificate:
* subject: C=IN; L=Chennai; CN=*.example.com; emailAddress=admin@example.com
* start date: 2014-03-26 18:39:20 GMT
* expire date: 2014-07-04 18:39:20 GMT
* common name: *.example.com (does not match '128.199.206.19')
* issuer: C=IN; L=Chennai; CN=*.example.com; emailAddress=admin@example.com
* SSL certificate verify result: self signed certificate (18), continuing anyway.
：提交
Jesin一
