Using SSL with a Wildcard Certificate on Multiple Apache Sites

It is possible to set up multiple virtual SSL-encrypted hosts (sites) in apache, but did you know it's possible for them all to use port 443 and the same IP address? Wildcard certificates help make it happen.
Setting up SSL virtual hosts in linux (specifically RHEL and CentOS, but the steps are similar in other distros) isn't hard, and--to correct a common misperception--it is possible to have multiple SSL virtual hosts running under apache using host headers. To be clear: you don't have to use separate IP addresses or different port numbers in order to have multiple SSL sites under apache.
In short, the process involves creating multiple SSL virtual hosts, each with its own host header (ServerName in apache parlance), and adding the same wildcard SSL certificate to each of the sites. There are a variety of ways to create a certificate, and you can see many of them discussed with a simple Google search. In our case, we'll use genkey from crypto-utils. Feel free to use any utility you'd like

Install Crypto-Utils

Crypto-utils is a package that contains a lot of programs for dealing with certificates and keys; it makes things a lot easier.

yum install crypto-utils

Generate the new key

Then simply run the genkey application:

genkey --days 3650 *.servername.com

You'll notice in the above example we set it to last for 10 years (why should it expire?) and contain the server name servername.com. Of course, you'd want to put the correct server name there.
The program will prompt you for some details; note that you'll not want to have the private key encrypted; that requires a password when you start apache, which isn't terribly convenient.
Genkey will create a file called *.servername.cert and *.servername.key in /etc/pki/tls/certs and /etc/pki/tls/private, respectively. These directories, I believe, are specific to RHEL (and CENTOS) 5; EL 4 and other distros use different directories. You'll want to rename these files when the process is complete: genkey creates the cert and key with the name you typed in, which means it'll be a filename with a * in it. That's no good, so when it's done, go to those directories and change the filename to wildcard.servername.cert and wildcard.servername.key.
When you've done that, your certificate is complete, and you're ready to set up your sites.
As an aside: it's not necessary that you use self-signed certificates. In fact, if you're setting this up for a production environment, you will want to use a commercially-provided certificate from a company such as GeoTrust, Verisign, or any of the myriad of certificate companies out there.

Edit ssl.conf

Now we add our virtual hosts (sites). Again, this directory location may be different for your distro.

vim /etc/httpd/conf.d/ssl.conf

If we were just installing this certificate for the default site, we'd just change the SSLCertificateFile and SSLCertificateKeyFile to point to the new files created in /etc/pki/tls/certs and /etc/pki/tls/private respectively.
But because we're creating (or adding certificates to) two new sites we'll have to change the SSLCertificateFile and SSLCertificateKeyFile not only in the default site, but add our additional sites as well. The following will create two additional sites called "testssl1" and "testssl2." They'll go right after the default <VirtualHost> </VirtualHost> section

NameVirtualHost *
<VirtualHost * >
SSLEngine on SSLProtocol all -SSLv2
SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
ServerAdmin webmaster@example.com
DocumentRoot /var/www/html/testssl1
ServerName testssl1.example.com
ErrorLog /var/log/httpd/testssl_error_log
CustomLog /var/log/httpd/testssl_access_log common
SSLCertificateFile /etc/pki/tls/certs/wildcard.example.com.cert
SSLCertificateKeyFile /etc/pki/tls/private/wildcard.example.com.key
</virtualhost>

<virtualhost *>
SSLEngine on SSLProtocol all -SSLv2
SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
ServerAdmin webmaster@example.com
DocumentRoot /var/www/html/testssl2
ServerName testssl2.example.com

ErrorLog /var/log/httpd/testssl_error_log
CustomLog /var/log/httpd/testssl_access_log common
SSLCertificateFile /etc/pki/tls/certs/wildcard.example.com.cert
SSLCertificateKeyFile /etc/pki/tls/private/wildcard.example.com.key
</virtualhost>

If you'd prefer simply to replace the default :443 site, simply comment out the entire section between the first <VirtualHost> </VirtualHost> section.
Note that there's a lot that can go wrong with the settings in this file, but, unlike using wildcard certificates, there is--happily--a lot of information on the web about troubleshooting this file.

Restart Apache

service httpd restart