--- title: 'Tutorial: Configure Multiple SSL Certificates with Server Name Indication (SNI) in Access Server' canonical: https://openvpn.net/as-docs/v3/tutorials/tutorial--multiple-ssl-certificates-with-sni/ product: Access Server Docs description: Learn how to configure Server Name Indication (SNI) in OpenVPN Access Server to serve multiple SSL certificates for different domain names on the same server. keywords: SNI multiple SSL certificates --- # Tutorial: Configure Multiple SSL Certificates with Server Name Indication (SNI) in Access Server ## Overview Server Name Indication (SNI) allows a single Access Server instance to present different SSL certificates based on the domain name requested by the client. This makes it possible to host multiple domains on the same Access Server while serving the correct SSL certificate for each domain. With this configuration, you can run **multiple domain SSL certificates on Access Server**, allowing different hostnames to use their own trusted certificates while pointing to the same server. This tutorial explains how to configure Server Name Indication in OpenVPN Access Server using the command-line interface. After completing this configuration, your Access Server can host multiple domains with different SSL certificates, enabling secure connections for each hostname. For example, you can configure: - `vpn1.company.com` to use Certificate A. - `vpn2.company.com` to use Certificate B. - The server IP address or unspecified domains to use the default certificate. This Access Server SNI configuration is useful when: - Hosting multiple VPN portals on one server. - Serving different organizations from the same Access Server. - Using separate domain certificates for branding or compliance. > **Tip** > > This is an advanced configuration and currently must be performed from the command line. There aren't corresponding options in the Admin Web UI. > > For general information on SSL certificates in Access Server, refer to [SSL Certificates on Access Server's Web Services](https://openvpn.net/as-docs/v3/ssl-certificates.md). ## Prerequisites Before configuring multiple web certificates on Access Server, ensure you have the following: - Access Server 3.1.0 or newer. - Console access and the ability to get root access. - A domain name pointing to your Access Server for each certificate. - For each domain, the following certificate files: - SSL certificate (`.crt`). - Private key (`.key`). - CA bundle or intermediate certificate (`.ca-bundle`). ## Configuration Concept Access Server always has a default SSL certificate configured. This certificate is presented when: - Users connect using the server IP address. - A domain name is requested that doesn't have a specific SNI entry. The default certificate uses the following configuration keys: | **Configuration Key** | **Description** | | --- | --- | | `cs.cert` | Default SSL certificate | | `cs.priv_key` | Private key for the default certificate | | `cs.ca_bundle` | CA bundle for the default certificate | > **Note** > > For managing the default certificate, refer to [Tutorial: Install a Signed SSL Certificate from the Command-line Interface](https://openvpn.net/as-docs/v3/tutorials/tutorial--ssl-certificate-command-line.md) ### How SNI works in Access Server SNI allows Access Server to present different certificates depending on the hostname requested by the client. Additional certificate mappings are stored under the `cs.sni` configuration namespace. Each SNI configuration block includes: | **Key** | **Description** | | --- | --- | | `cs.sni..domains.` | Domain name that triggers this certificate. | | `cs.sni..cert` | SSL certificate | | `cs.sni..priv_key` | Private key | | `cs.sni..ca_bundle` | CA bundle | Where: - **Identifier** = a unique name you define for the certificate set - **index** = a number starting at `0` ## Step-by-step configuration example In this example, Access Server will serve: | **Domain** | **Certificate** | | --- | --- | | `vpn1.company.com` | Certificate A | | `vpn2.company.com` | Certificate B | | Server IP or other domains | Default certificate | ## Step 1: Prepare the certificates Prepare the SSL certificate files for each domain that will use SNI. 1. Connect to your Access Server console and get root privileges. 2. Create directories to store the certificate files for each domain: ``` mkdir --parents /etc/webcerts/vpn1.company.com/ mkdir --parents /etc/webcerts/vpn2.company.com/ ``` 3. Upload the following files to the appropriate directory for each domain: - SSL certificate (`.crt`). - Private key (`.key`). - CA bundle or intermediate certificate (`.ca-bundle`). > **Tip** > > Example directory structure: > > ``` > /etc/webcerts/vpn1.company.com/vpn1.company.com.crt > /etc/webcerts/vpn1.company.com/vpn1.company.com.key > /etc/webcerts/vpn1.company.com/vpn1.company.com.issuer.crt > ``` 4. You can upload the files using: - SCP or SFTP. - A file transfer application. - `wget` if downloading from a remote source. > **Important** > > Ensure the certificates are in **PEM format**. Access Server doesn't support .p12 or .pfx certificate formats. You can convert files from .pfx to PEM type with the DigiCert Certificate Utility for Windows. ## Step 2: Configure the first SNI certificate Configure Access Server to serve a certificate when the domain **vpn1.company.com** is requested. The identifier **forvpn1company** is a unique label used for this SNI configuration. 1. Connect to the Access Server console and get root privileges. 2. Configure the domain name that will trigger the certificate: ``` sacli --key "cs.sni.forvpn1company.domains.0" --value "vpn1.company.com" ConfigPut ``` 3. Configure the SSL certificate: ``` sacli --key "cs.sni.forvpn1company.cert" \ --value_file /etc/webcerts/vpn1.company.com/vpn1.company.com.crt \ ConfigPut ``` 4. Configure the private key: ``` sacli --key "cs.sni.forvpn1company.priv_key" \ --value_file /etc/webcerts/vpn1.company.com/vpn1.company.com.key \ ConfigPut ``` 5. Configure the CA bundle: ``` sacli --key "cs.sni.forvpn1company.ca_bundle" \ --value_file /etc/webcerts/vpn1.company.com/vpn1.company.com.issuer.crt \ ConfigPut ``` ## Step 3: Configure an additional SNI certificate Configure a second domain, **vpn2.company.com**, to use a different certificate. The identifier **forvpn2company** is a unique label used for this SNI configuration. 1. Configure the domain that will trigger the certificate: ``` sacli --key "cs.sni.forvpn2company.domains.0" --value "vpn2.company.com" ConfigPut ``` 2. Configure the SSL certificate: ``` sacli --key "cs.sni.forvpn2company.cert" \ --value_file /etc/webcerts/vpn2.company.com/vpn2.company.com.crt \ ConfigPut ``` 3. Configure the private key: ``` sacli --key "cs.sni.forvpn2company.priv_key" \ --value_file /etc/webcerts/vpn2.company.com/vpn2.company.com.key \ ConfigPut ``` 4. Configure the CA bundle: ``` sacli --key "cs.sni.forvpn2company.ca_bundle" \ --value_file /etc/webcerts/vpn2.company.com/vpn2.company.com.issuer.crt \ ConfigPut ``` You can repeat this process for additional domains if your Access Server hosts multiple domains with separate SSL certificates. ## Step 4: Restart Access Server Restart Access Server so the new SNI configuration is applied. 1. Restart the Access Server service: ``` sacli start ``` 2. Wait for the service restart to complete before testing the configuration. ## Step 5: Verify the SNI configuration After restarting Access Server, verify that the correct SSL certificate is served for each domain. 1. Open a web browser and navigate to the first configured domain, **https://vpn1.company.com:943**. > **Note** > > By default, Access Server web services listen on TCP port 943 (Admin and Client Web UI) and TCP port 443 for redirected HTTPS access. 2. Inspect the SSL certificate presented by the server. You can usually do this by clicking the **padlock icon** in the browser address bar. 3. Confirm that the certificate matches the one configured for `vpn1.company.com`. 4. Navigate to the second configured domain, **https://vpn2.company.com:943**. > **Note** > > By default, Access Server web services listen on TCP port 943 (Admin and Client Web UI) and TCP port 443 for redirected HTTPS access. 5. Inspect the certificate again and confirm that it matches the one configured for `vpn2.company.com`. 6. Navigate to Access Server using its IP address. Example: **https://203.0.113.5:943**. 7. Verify that the default certificate is presented when accessing the server via IP address or a domain without an SNI entry. Verify the SSL certificate is present for each domain from the command line. 1. Connect to the console and get root privileges. 2. Run the following command to check the certificate presented for the domains: ``` echo | openssl s_client -connect vpn1.company.com:943 -showcerts 2>/dev/null | openssl x509 -noout -subject -issuer -dates echo | openssl s_client -connect vpn2.company.com:943 -showcerts 2>/dev/null | openssl x509 -noout -subject -issuer -dates echo | openssl s_client -connect 203.0.113.5:943 -showcerts 2>/dev/null | openssl x509 -noout -subject -issuer -dates ``` - Example output: ``` root@openvpnas:~# echo | openssl s_client -connect vpn1.company.com:943 -showcerts 2>/dev/null | openssl x509 -noout -subject -issuer -dates subject=CN = vpn1.company.com issuer=C = US, ST = NA, L = NA, O = MyOrg, OU = IT, CN = MyRootCA notBefore=Mar 12 03:43:16 2026 GMT notAfter=Jun 14 03:43:16 2028 GMT root@openvpnas:~# echo | openssl s_client -connect vpn2.company.com:943 -showcerts 2>/dev/null | openssl x509 -noout -subject -issuer -dates subject=CN = vpn2.company.com issuer=C = US, ST = NA, L = NA, O = MyOrg, OU = IT, CN = MyRootCA notBefore=Mar 12 03:43:47 2026 GMT notAfter=Jun 14 03:43:47 2028 GMT root@openvpnas:~# echo | openssl s_client -connect 203.0.113.5:943 -showcerts 2>/dev/null | openssl x509 -noout -subject -issuer -dates subject=CN = 203.0.113.5 issuer=CN = OpenVPN Web CA 2026.03.12 11:09:10 -05 openvpnas notBefore=Mar 11 11:09:32 2026 GMT notAfter=Mar 12 11:09:32 2027 GMT ``` 3. You should receive these expected results: - `vpn1.company.com` should return Certificate A. - `vpn2.company.com` should return Certificate B. - The server IP address should return the default Access Server certificate. ## Step 6: Remove an SNI configuration If you no longer need a domain-specific certificate, you can remove the SNI configuration. 1. Connect to the Access Server console and get root privileges. 2. Delete the configuration keys associated with the SNI identifier. Example: removing the **forvpn1company** entry: ``` sacli --key "cs.sni.forvpn1company.domains.0" ConfigDel sacli --key "cs.sni.forvpn1company.cert" ConfigDel sacli --key "cs.sni.forvpn1company.priv_key" ConfigDel sacli --key "cs.sni.forvpn1company.ca_bundle" ConfigDel ``` 3. Restart Access Server to apply the changes: ``` sacli start ``` 4. Verify that the configuration was removed by navigating to the domain in a browser. > **Tip** > > You can confirm the SNI configuration from the command line. Run the following to list all configured SNI entries and their associated domains: > > ``` > sacli ConfigQuery | grep cs.sni > ``` --- Prev: [Tutorial: How to Manually Regenerate Self-signed Certificates](https://openvpn.net/as-docs/v3/tutorials/tutorial--regenerate-self-signed-certificate.md) Next: [Tutorial: Recovering SSL Web Certificates from the Config DB](https://openvpn.net/as-docs/v3/tutorials/tutorial--recover-web-cert-config-db.md) Index: https://openvpn.net/as-docs/llms.txt