Multiple SSL certs for same listener

[tecnobrat]

Does fabio provide a way to have multiple SSL certs attached to the same listener?

I would like to be able to have two wildcard certs, say *.tugboat.zone and *.tugboat.info, which point to the same fabio instance, and have them both work correctly.

Am I missing from the docs on how to make this work? Or is it not possible?

[magiconair]

Checkout the path, consul, http or vault cert store. They all support multiple certs based on SNI.

[tecnobrat]

I'm not sure I understand. SNI makes the upstream handle the cert, does it not?

I'd like to handle the cert in fabio.

[tecnobrat]

I'm very confused, I can't find any example of multiple certs on the same listener in teh docs, so if you can point me in the right direction I'd be appreciative.

[magiconair]

https://github.com/fabiolb/fabio/blob/master/fabio.properties#L27-L51

You create a directory for the certificates and put them there. Then you configure a path cert source, e.g.

fabio -proxy.cs 'cs=ssl;type=path;cert=path/to/certs' -proxy.addr ':443;cs=ssl'

Then in path/to/certs you put

foo.com-cert.pem
foo.com-key.pem
bar.com.pem # contains both cert and key

For a request on port 443 fabio will check whether it can find a matching cert based on the server name.

[tecnobrat]

Oh crap, so path instead of file, and then fabio will do the magic! ... I was using file, and didn't realize that subtle difference.

Thanks muchly!

[tecnobrat]

That worked perfectly, thanks muchly.

[magiconair]

Cool. Glad I could help.