Can a server offer more than one TLS certificate?

ByteEater

6/9/23, 12:18 PM

Let's say I have a TLS certificate for a domain but I'm not sure if all user agents potentially connecting over HTTP would accept it. Can I obtain another certificate, signed by another certificate authority, and use it in such cases as a fallback, transparently to the user? If it's possible, how would the client-server communication to establish a secure connection proceed? And is this use case well known and supported in configuration of popular HTTP servers?

I know there are similar questions but they ask about varying the used certificate by subdomain (possible) or path prefix (impossible IIUC because at negotiation time the server knows only the authority, not the full Request-URI).

0 + 0

ssl

certificate

http

configuration

web-server

Paul

6/9/23, 1:48 PM

I don't have a source for this, other than to state that I see many Cloudflare sites, especially, with both an EC and RSA certificate. I'm guessing the client is deciding which one to use.

Score:2

Server

Bob

6/9/23, 2:29 PM

Can a server offer more than one TLS certificate?

A server can support more than one TLS certificate. But it can only offer a single TLS certificate in the TLS handshake with the client. AFAIK that is the limit set in the TLS (handshake) protocol RFC 5246

The capability to support multiple certificates is most frequently used when you have several different domain names that all point to the same server.

Server Name Indication sends the hostname of the server in the TLS handshake made by the client. That allows the server to select the best matching certificate to use for that connection. I.e. the server can then use the certificate for www.example.com when the client indicates that it wants to connect to www.example.com and it can use a different (or default) certificate when the client is connecting with for example only the IP-address, no hostname or a different hostname in the ClientHello message.

In addition to the server name from the ClientHello TLS handshake message a server can be configured to use other parameters to select a different certificate.

For example when during the TLSv1.2 handshake the client indicates that the first preference is to use elliptic curves rather than RSA , then an ECDSA key/certificate can be offered and for clients that don't, an RSA certificate can be offered instead.
See for example https://www.haproxy.com/blog/serving-ecc-and-rsa-certificates-on-same-ip-with-haproxy/ and/or https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslcertificatefile

You can do the same with for example legacy clients that don't support ciphers above TLSv1.0

But once the certificate has been selected by the server, there is no fallback, the client either accepts or rejects the offered certificate.

0 + 0

ByteEater

6/9/23, 7:43 PM

[This answer](https://security.stackexchange.com/a/46992) quotes RFC 5426, Section 7.4.1.1: "The HelloRequest message MAY be sent by the server at any time." Can it be used to offer another certificate when the client has rejected the previously offered one?

Bob

6/10/23, 6:29 AM

It is difficult to send something though once the client has broken off the connection because it cannot validate the server certificate...

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Can a server offer more than one TLS certificate?

TH: เซิร์ฟเวอร์สามารถเสนอใบรับรอง TLS มากกว่าหนึ่งรายการได้หรือไม่

RO: Poate un server să ofere mai mult de un certificat TLS?

RU: Может ли сервер предлагать более одного сертификата TLS?

VI: Máy chủ có thể cung cấp nhiều chứng chỉ TLS không?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.