Configure multi-domain HTTPS websites on a single CLB instance-Server Load Balancer(SLB)-阿里云帮助中心

This topic describes how to configure a single listener on a Classic Load Balancer (CLB) instance to route HTTPS requests for different domain names to different backend servers, allowing you to host multiple HTTPS websites.

Example

The CLB instance inspects the domain name in the HTTPS request, selects the matching certificate to complete authentication, and then forwards the request to the appropriate backend server based on your forwarding rules.

This topic uses the following configuration as an example:

The listener's default certificate, named default, is associated with the domain name aliyundoc.com. The default server group is RS1.
An additional certificate, example1, is associated with the domain name www.example.com. Requests to https://www.example.com are routed to server group RS1.
Another additional certificate, example2, is associated with the domain name www.example.org. Requests to https://www.example.org are routed to server group RS2.

Prerequisites

A CLB instance is created. For more information, see Create and manage a CLB instance.
Two vServer groups, RS1 and RS2, are created. For more information, see Create and manage a vServer group.
An ECS instance, ECS01, is added to RS1, and another ECS instance, ECS02, is added to RS2. Application services are deployed on both ECS01 and ECS02.
You have registered domain names and completed ICP filing. For more information, see Register a domain name on Alibaba Cloud and ICP filing process.
You must purchase or upload certificates from a third-party provider to Certificate Management Service and bind them to their respective domain names. For more information, see Enable HTTPS access for a web-based service by using an official certificate. The following certificates are required for this topic:
- A default certificate named default that is bound to the domain name aliyundoc.com.
- A certificate named example1 that is bound to the domain name www.example.com.
- A certificate named example2 that is bound to the domain name www.example.org.
Note
You must deploy the certificates to the CLB instance before they can be used. For more information, see Create a certificate.

Step 1: Add an HTTPS listener

Log on to the CLB console.
In the top menu bar, select the region where the CLB instance is located.
On the Instances page, find the target CLB instance, and in the Actions column, click Configure Listener.
On the Protocol & Listener tab, configure the following parameters and click Next.
This topic describes only the required parameters. You can leave other parameters at their default values or configure them as needed.
- Select Listener Protocol: Select HTTPS.
- Listener Port: Set the port to 443.
On the Certificate Management Service tab, select the uploaded server certificate and click Next. In this example, we select the default certificate.
On the Backend Servers tab, select vServer group, and then select RS1 from the Server Group drop-down list.
Keep the default values for the other parameters and click Next until you reach the confirmation step. Then, click Submit.

Step 2: Add additional domain names

On the Instances page, find the target CLB instance, and then click the target instance ID.
On the Listener tab, find the HTTPS listener that you created. In the Actions column, click the icon and select Manage Additional Certificate.
In the Manage Additional Certificate panel, click Add Additional Certificate.
1. For Additional Certificate, enter www.example.com. From the Server Certificate drop-down list, select the certificate associated with www.example.com, and then click OK.
2. For Additional Certificate, enter www.example.org. From the Server Certificate drop-down list, select the certificate associated with www.example.org, and then click OK.
Note
Ensure the domain name in the certificate exactly matches the additional domain name you add.
Note
Keep the following limitations in mind when you add additional domain names:
- Wildcard domain names do not support SNI matching. Wildcard additional domain names such as *.example.com cannot be matched via SNI during the TLS handshake. When a client specifies a subdomain name in the SNI field, CLB cannot use the wildcard additional domain name to select the corresponding certificate. Use exact-match domain names such as www.example.com as additional domain names.
- Forwarding rules are required. An additional domain name must be used together with a forwarding rule. If you add an additional domain name without configuring a corresponding forwarding rule in Step 3, SNI does not take effect and CLB handles the request by using the default certificate.
- Default certificate fallback. If an HTTPS request does not match any additional domain name, CLB uses the default certificate to process the request. This is expected behavior.
- Expired certificate fallback. When the server certificate associated with an additional domain name expires, CLB automatically skips the SNI matching logic for the expired certificate. Even if the domain name in the client's SNI field exactly matches the expired certificate's domain, CLB does not use the expired certificate and instead falls back to the default certificate configured on the HTTPS listener. This may cause clients to receive the default certificate instead of the expected domain-specific certificate, resulting in SSL/TLS certificate mismatch warnings. To avoid service disruptions, renew certificates for additional domain names before they expire.

Step 3: Configure forwarding rules

On the Instances page, click the ID of the target CLB instance.
On the Listener tab, find the listener and click Set Forwarding Rule in the Actions column.
In the Add Forwarding Rules panel, add forwarding rules.
In this example, only domain name-based forwarding rules are configured. The URL settings are not configured.
1. In the Domain Name column, enter www.example.com, select the vServer group RS1, and then click Add Forwarding Policy.
2. In the Domain Name column, enter www.example.org, select the vServer group RS2, and then click Add Forwarding Policy.
After you configure the forwarding rules, close the Add Forwarding Rules panel.

Step 4: Configure domain name resolution

Add A records for www.example.com and www.example.org to point to the public IP address of the CLB instance.

Log on to the CLB console.
In the top navigation bar, select a region.
Select the CLB instance for domain name resolution, and copy its corresponding public IP address.

To add an A record:

Log on to the Alibaba Cloud DNS console.
On the Public Zone page, click Add Zone.
In the Add Zone dialog box, enter your domain name and click OK.
Important
Verify your domain ownership by using a TXT record.
Find the domain name that you want to manage and click Settings in the Actions column.
On the Settings page, click Add Record.

In the Add Record panel, configure the following parameters to add an A record and then click OK.

Parameter	Description
Record Type	Select A from the drop-down list.
Hostname	The prefix of your domain name.
Query Source	Select Default.
Record Value	The record value is the public IP address of the CLB instance that you copied.
TTL	Time to live (TTL). This specifies the amount of time that the DNS record is cached on a DNS server. This example uses the default value.

Step 5: Verify the results

After completing the configuration, enter https://www.example.com and https://www.example.org in a browser to verify that the forwarding rules work correctly. This example assumes you have deployed a simple static web page on each backend server.

Enter https://www.example.com in your browser. The request is routed to ECS01 in server group RS1. The page displays Hello World ! This is ECS01.
Enter https://www.example.org in your browser. The request is routed to ECS02 in server group RS2. The page displays Hello World ! This is ECS02.

Note

If the test fails, try clearing your browser cache and testing again.

FAQ

Q: After I configure additional domain names, HTTPS requests still return the default certificate. How do I troubleshoot?

Check whether you are using exact-match domain names. Wildcard domain names such as *.example.com do not support automatic SNI matching on CLB. Use exact-match domain names such as www.example.com as additional domain names.
Check whether forwarding rules are configured. An additional domain name alone is not sufficient for SNI to take effect. You must also configure a forwarding rule for each additional domain name. See Step 3: Configure forwarding rules to verify that a forwarding rule exists for your additional domain name.
Check whether the certificate domain name matches the additional domain name. The domain name in the certificate must exactly match the additional domain name you configured. Mismatches cause CLB to fall back to the default certificate.
Verify SNI behavior by using openssl. Run the following command to check which certificate CLB returns for a specific domain name:
```
openssl s_client -connect <CLB_VIP>:443 -servername <domain_name>
```
In the output, check the subject field of the returned certificate. If the subject shows the default domain name instead of your intended domain name, verify that the additional domain name and forwarding rule are configured correctly.
Verify the extension domain configuration in the console. On the Instances page, click the target CLB instance ID, go to the Listeners tab, find the HTTPS listener, and in the Actions column choose > Manage Certificates to check the default certificate and configured extension domains. If the Manage Additional Certificate list is empty, no extension domains are configured and all HTTPS requests use the default certificate of the listener. Follow Step 2 to add extension domains for each domain and bind the corresponding server certificates.
Verify the extension domain configuration by using the API. Call the DescribeLoadBalancerHTTPSListenerAttribute API to query the DomainExtensions field and check the extension domain configuration status. If the response contains "DomainExtension": [] (empty array), no extension domains are configured and all domain requests use the default certificate. When extension domains are configured, verify that the Domain and ServerCertificateId fields in each entry match the expected domain and certificate.
Understand the wildcard certificate matching limitation. If the server certificate bound to an extension domain is a wildcard certificate (the binding domain is in *.example.com format), note the following: when multiple extension domains under the same HTTPS listener use wildcard certificates, only the first wildcard certificate is automatically used for SNI matching. The remaining extension domains must be bound with individual exact-match domain certificates; otherwise, the listener's default certificate is returned.