https://bz.apache.org/bugzilla/show_bug.cgi?id=57108
--- Comment #10 from Unlogic <unlo...@unlogic.se> --- Well this is a bit tricky because there is two sides to this coin. In some cases you have a wildcard certificates or subject alternative name certificates the cover lots of domains. In those cases the current connector based approach works fine fine. But if you turn things around and have lets say 50 domains all with their own host and certificate and maybe even a few aliases for some hosts that in turn also require separate certificates. In that case the host based approach would make things simpler since you can put everything inside the hosts element. A trade off between the two solutions could be to define the keystores using a separate element in the config like when you define a connection pool. And then make it possible for both the connectors, hosts and aliases to refer back to the defined keystores depending on the use case. Here's an example: <Keystore name="firstKeystore" truststoreFile="..." (and other truststore attributes) keystoreFile="..." (and other keystore attributes) [other allowed configuration attributes]> <Keystore name="secondKeystore" truststoreFile="..." (and other truststore attributes) keystoreFile="..." (and other keystore attributes) [other allowed configuration attributes]> <Keystore name="thirdKeystore" truststoreFile="..." (and other truststore attributes) keystoreFile="..." (and other keystore attributes) [other allowed configuration attributes]> <Connector ... /> (a generic https connector not bound to any particular keystore that instead looks up the keystore based on the host/alias) <Connector keystoreRef="firstKeystore" ... /> (a https connector bound to the specified keystore like current tomcat versions) <Host name="hostone.com"... /> (a host not bound to any particular keystore) <Host name="hosttwo.net" keystoreRef="secondKeystore" ... /> <Host name="hostthree.net" keystoreRef="secondKeystore" ...> <Alias keystoreRef="thirdKeystore">foo.com</Alias> <Alias keystoreRef="firstKeystore">boo.com</Alias> <Alias>moo.com</Alias> </Host> I hope that my example makes sense. It would make the keystore/certificate configuration a bit more flexible and support "both sides of the coin". -- You are receiving this mail because: You are the assignee for the bug. --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org