SecurityContext (HttpServer.bindSecure) with multiple hosts.

[isoos]

I couldn't find any example, test or documentation on how to create a https server with multiple hostnames (separate certificates for each hosts). Is is supported?

[mit-mit]

cc @jonasfj @sortie

[jonasfj]

Maybe if you concatenate the certificates.... You can certainly do multiple hostnames in a single certificate. Regardless, I think this is a pretty advanced feature.

---

But really, I would recommend terminating TLS before you hit your Dart server.

[gmpassos]

Any example in how to do build a SecurityContext with multiple domains?

Or how to concatenate the certificates? I tried some variations here, but I can't make it work.

[isoos]

Also, relevant and useful package on pub.dev, with @gmpassos as the author, which could really use this multi-host binding: https://pub.dev/packages/shelf_letsencrypt

[gmpassos]

To generate a PKCS12 with multiple domains certificates generated with the same key pair (same private key) and with the password xyz:

openssl pkcs12 -export \
-inkey /path/to/privkey.pem \
-in /path/to/domain1.com/fullchain.pem -name domain1.com \
-certfile /path/to/domain2.com/fullchain.pem -name domain2.com \
-out /path/to/keystore-multi.pfx -passout pass:xyz

To generate aPKCS12 with multiple domains certificates WITHOUT add a private key and with the password xyz:

openssl pkcs12 -export \
-nokeys \
-in /path/to/domain1.com/fullchain.pem -name domain1.com \
-certfile /path/to/domain2.com/fullchain.pem -name domain2.com  \
-out /path/to/keystore-multi.pfx -passout pass:xyz

The Dart code to load this:

var password = 'xyz';
var fullchainFile = '/path/to/keystore-multi.pfx';
var privateKeyFile = '/path/to/privkey.pem';

var sc = SecurityContext()
  ..useCertificateChain(fullchainFile, password: password)
  ..usePrivateKey(privateKeyFile, password: password);

Note that if you use a private key that won't match the certificates you will get an exception while loading the them.

The only way that I was able to load multiple certificates was using multiple domains certificates generated with the same private key (yes this is allowed).

But this is still not enough, since the SecurityContext will always respond with the 1st domain in the PKCS12 file!
So the HTTPS request will work only for the 1st domain in the PKCS12 file.

It seems that the Dart implementation is not looking for the correct certificate subject (subject=CN = domainX.com).

[gmpassos]

FYI:

sdk/runtime/bin/security_context.cc

Line 538 in e995cb5

status = SSL_CTX_use_certificate(context, ca);

[gmpassos]

FYI:

sdk/runtime/bin/secure_socket_filter.cc

Line 614 in e995cb5

// TODO(24071): Check return value of SSL_get_verify_result, this

[gmpassos]

@mit-mit @kevmoo
We need a task force for this issue. This is very important.

[kevmoo]

FYI @brianquinlan

[gmpassos]

Any update on the issue?

[kevmoo]

@brianquinlan ?

[gmpassos]

How can I help to push this issue?