ok I got it working on my test system. Some configuration is needed to have 2 domains with 2 different SSL certs.
Basically the first domain I created using plain installation of Lighttpd & certbot. Certificate was created using dietpi-letsencrypt. That’s our the default setup.
Now we need to create the 2nd set of certificated for the 2nd domain
certbot certonly --webroot -w /var/www2 -d my2.domain.com
This will create a new directory inside /etc/letsencrypt/live/
ok let’s setup the 2nd domain
mkdir /var/www2 # or whatever web root you like
nano /etc/lighttpd/conf-enabled/20-2nd-domain.conf
I added following to specify web root and the certificates for the 2nd domain. Remove the IPv6 stuff if not needed.
$HTTP["host"] =~ "(^|\.)my2.domain.com$" {
server.document-root = "/var/www2"
server.errorlog = "/var/log/lighttpd/error2.log"
$SERVER["socket"] == ":443" {
protocol = "https://"
ssl.engine = "enable"
ssl.pemfile = "/etc/letsencrypt/live/my2.domain.com/fullchain.pem"
ssl.privkey = "/etc/letsencrypt/live/my2.domain.com/privkey.pem"
ssl.ca-file = "/etc/letsencrypt/live/my2.domain.com/fullchain.pem"
# For DH/DHE ciphers, dhparam should be >= 2048-bit
#ssl.dh-file = "/path/to/dhparam.pem"
# ECDH/ECDHE ciphers curve strength, see "openssl ecparam -list_curves"
ssl.ec-curve = "secp384r1"
# Environment flag for HTTPS enabled
setenv.add-environment = ( "HTTPS" => "on" )
# Intermediate configuration, tweak to your needs
ssl.openssl.ssl-conf-cmd = ("MinProtocol" => "TLSv1.2")
ssl.cipher-list = "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384"
ssl.honor-cipher-order = "disable"
ssl.disable-client-renegotiation = "enable"
}
# IPv6
$SERVER["socket"] == "[::]:443" {
protocol = "https://"
ssl.engine = "enable"
ssl.pemfile = "/etc/letsencrypt/live/my2.domain.com/fullchain.pem"
ssl.privkey = "/etc/letsencrypt/live/my2.domain.com/privkey.pem"
ssl.ca-file = "/etc/letsencrypt/live/my2.domain.com/fullchain.pem"
# For DH/DHE ciphers, dhparam should be >= 2048-bit
#ssl.dh-file = "/path/to/dhparam.pem"
# ECDH/ECDHE ciphers curve strength, see "openssl ecparam -list_curves"
ssl.ec-curve = "secp384r1"
# Environment flag for HTTPS enabled
setenv.add-environment = ( "HTTPS" => "on" )
# Intermediate configuration, tweak to your needs
ssl.openssl.ssl-conf-cmd = ("MinProtocol" => "TLSv1.2")
ssl.cipher-list = "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384"
ssl.honor-cipher-order = "disable"
ssl.disable-client-renegotiation = "enable"
}
}
ok last step is to ensure certificates for domain 1 are used in case this one is accessed only.
nano /etc/lighttpd/conf-enabled/50-dietpi-https.conf
Basically I added 2 lines. First one right below server.modules += ( “mod_openssl” ). Like this
server.modules += ( "mod_openssl" )
$HTTP["host"] =~ "(^|\.)my1.domain.com$" { # new line
and to close the $HTTP[“host”] block a } at the end/last line
finally restart Lighttpd
systemctl restart lighttpd.service
Close the browser and try again.
Whole stuff is based on following 2 Lighttpd forum posts.
https://redmine.lighttpd.net/boards/2/topics/9612?r=9615#message-9615
https://redmine.lighttpd.net/boards/2/topics/546
