Is it possible to have multiple SSL certificates?

[LECOQQ]

Hello!

I'm currently trying to reverse proxy cockpit to my domain names. I have been following the tutorial provided by your documentation, and so far it has worked perfectly for my first domain name.
Now i'm trying to do the same for a second domain name, and the reverse proxy is working fine. Though, the certificate isn't good, as it is using the certificate from the first domain name.
Is it possible to use 2 (or even more) SSL certificates with cockpit? I have tried merging both certificates together, and did the instructions that worked for the first domain name (cf https://cockpit-project.org/guide/latest/https.html), but it isn't good still.

Thanks!

[martinpitt]

Every web service (cockpit, smtp, http, and anything else) can have at most one certificate. What you need to do is to modify the certificate's subjectAltName: field to enumerate all valid domain names.

[michaelbeaumont]

Every web service (cockpit, smtp, http, and anything else) can have at most one service

I'm not sure what this means. Is there any reason Cockpit can't use SNI to choose the most appropriate certificate to present to the client from a set of certificates?

[martinpitt]

Err, sorry, I meant to write "at most one certificate". I updated the comment above.

No, Cockpit does not do SNI, only a single certificate. For anything complex you need to set up your own reverse proxy. And apparently you already have one? Then cockpit would only speak plain http, and doesn't need certificates at all.

See e.g. https://github.com/cockpit-project/cockpit/wiki/Proxying-Cockpit-over-Apache-with-LetsEncrypt or https://github.com/cockpit-project/cockpit/wiki/Proxying-Cockpit-over-NGINX

[LECOQQ]

Heya, thanks for the answer. I'll try modifying the subjectAltName field to add both my domain names (DOMAIN_NAME.fr and DOMAIN_NAME.com). I already have a reverse proxy with nginx to connect from afar, and it's working fine for cockpit with my first domain name, but when adding the second one, the certificate is emanating from the first one thus leading to an unsecure connection on my browser.
I'll try later and give news about my issue :)
Thks again !

[martinpitt]

Hmm, that is between nginx, the certificate, and the browser. Perhaps check with Firefox' "Network" inspector that it sends an expected "Host:" header in the request, and make sure it matches the SAN? Also, validate with openssl x509 -in yourserver.pem -text or inspecting the certificate in the browsr that it actually contains the correct "X509v3 Subject Alternative Name"? This is a bit fiddly to do with openssl. (We do this in https://github.com/cockpit-project/cockpituous/tree/main/tasks/credentials for our infra)