Rule to assign different SSL Keys based on Host Header

This shouldn't be possible. It's a limitation of how HTTPS works.

 

 

First, the client connects to the server on port 443. SSL is negotiated. Then the client sends the HTTP GET/HEAD/etc, and the Host: header.

 

 

The SSL cert is presented *BEFORE* the Host: header is sent. The server *MUST* send a cert before it knows which one it should choose. Unless v9 includes a mind-reading module, this shouldn't be possible.

 

 

I could kick the SSL developers from not allowing a 'server identification suggestion' from the client as part of the SSL negotiation.