<document>
<header>
<product>resin</product>
<title>Security FAQ</title>
<description>
</description>
</header>

<body>
<summary objsummary-in-localtoc='1'/>
<faq title="Can I use different SSL certificates for each virtual host?">
<description>
<p>We have two domains on one server.  Is there an example config file showing
how to have multiple ssl certificates, one for each virtual host?</p>
</description>

<p>This is not possible if you are using Resin's virtual hosting capability to
serve to multiple domain names using a single IP address.</p>

<p>The SSL connection (and certificate) are handled before the HTTP request is
sent.  Unless the domain name is mapped to a unique ip address, the server
doesn't know which domain name the user is using until after SSL is set up.
There is no way for Resin to determine which domain name the user has specified
in the url.</p>

<p>It is possible  if you have separate IP addresses for the hosts.  You would
start seperate <a config-tag='http'/> servers that only bind on that ip
address.  Each of these <a config-tag='http'/> servers can have seperate ssl
configurations.</p>

</faq>
<faq title="Why does Resin say I need OPENSSL_THREADS when I try to use OpenSSL?">
<description>
<p>
Resin dies with an error on startup  "Resin requires a threaded version of OpenSSL.  OpenSSL must be compiled with OPENSSL_THREADS for Resin to use it."
</p>
</description>

<p>
Resin requires a threaded version of the OpenSSL libraries.  Usually a threaded
version is the default for OpenSSL, however on some systems it is necessary to
explicitly request a thread version.  
</p>
<p>
To recompile the openssl libraries with threading enabled:
</p>

<example>
$ cd openssl-0.9.7c
$ ./config threads
$ make
$ make install
</example>


<p>
The INSTALL document from the OpenSSL package contains more
information on the <code/threads/> option.
</p>

</faq>

<faq title="What is the sequence of handshakes for an SSL connection?">
<description>
</description>
<example>
ClientHello-&gt; 
&lt;-ServerHello
&lt;-CertificateChain
&lt;-ServerHelloDone
ClientKeyExchange-&gt;
ChangeCipherSpec-&gt;
Finished-&gt;
&lt;-ChangeCipherSpec
&lt;-Finished
</example>
</faq>


</body>
</document>
