Hello OpenLiteSpeed team,
I am experiencing an issue with sslEnableMultiCerts in OpenLiteSpeed 1.9.0
Environment:
- OpenLiteSpeed version: 1.9.0 (BUILD: built: Thu May 7 15:34:11 UTC 2026)
- OS: Ubuntu 22.04
- SSL library: BoringSSL (as reported in logs)
- sslEnableMultiCerts 1 is enabled
Configuration:
vhssl {
keyFile /path/to/privkey.pem
certFile /path/to/fullchain.pem
sslProtocol 30
}
Files present:
/path/to/fullchain.pem -> RSA certificate
/path/to/fullchain.pem.ecc -> ECDSA certificate
/path/to/privkey.pem -> RSA key
/path/to/privkey.pem.ecc -> ECDSA key
Expected behavior:
- Clients that support ECDSA cipher suites should receive the ECDSA certificate.
- Clients that do not support ECDSA (RSA-only) should receive the RSA certificate.
Actual behavior:
- All clients receive the ECDSA certificate.
- RSA-only clients fail to complete TLS handshake.
Test:
openssl s_client -connect press.bungee.host:443 -tls1_2 -cipher 'ECDHE-RSA-AES128-GCM-SHA256'
Result: Handshake fails (Cipher is (NONE)).
openssl s_client -connect press.bungee.host:443 -tls1_2 -cipher 'ECDHE-ECDSA-AES128-GCM-SHA256'
Result: Handshake succeeds with ECDSA certificate.
Additional findings:
I checked the source code of v1.9.0 and v1.9.1 from GitHub. In SslContext::servername_cb(), the ECDSA context is only selected if F_ECDSA_AVAIL flag is set. This flag is set in select_cert_cb(), which is registered by initSniMultiCert() and enableSelectCertCb(). However, in the published source code, VHostMap::setSslContext() calls initSNI() (not initSniMultiCert()), and enableSelectCertCb() is never called. So it appears select_cert_cb() is not invoked at all.
Could you please clarify:
1. Is sslEnableMultiCerts with RSA+ECDSA supposed to work in OpenLiteSpeed 1.9.0?
2. Why does the installed binary behave differently from the published source code?
3. Is there a known issue or required configuration to make RSA fallback work?
Thank you.
Best regards,
Petr
I am experiencing an issue with sslEnableMultiCerts in OpenLiteSpeed 1.9.0
Environment:
- OpenLiteSpeed version: 1.9.0 (BUILD: built: Thu May 7 15:34:11 UTC 2026)
- OS: Ubuntu 22.04
- SSL library: BoringSSL (as reported in logs)
- sslEnableMultiCerts 1 is enabled
Configuration:
vhssl {
keyFile /path/to/privkey.pem
certFile /path/to/fullchain.pem
sslProtocol 30
}
Files present:
/path/to/fullchain.pem -> RSA certificate
/path/to/fullchain.pem.ecc -> ECDSA certificate
/path/to/privkey.pem -> RSA key
/path/to/privkey.pem.ecc -> ECDSA key
Expected behavior:
- Clients that support ECDSA cipher suites should receive the ECDSA certificate.
- Clients that do not support ECDSA (RSA-only) should receive the RSA certificate.
Actual behavior:
- All clients receive the ECDSA certificate.
- RSA-only clients fail to complete TLS handshake.
Test:
openssl s_client -connect press.bungee.host:443 -tls1_2 -cipher 'ECDHE-RSA-AES128-GCM-SHA256'
Result: Handshake fails (Cipher is (NONE)).
openssl s_client -connect press.bungee.host:443 -tls1_2 -cipher 'ECDHE-ECDSA-AES128-GCM-SHA256'
Result: Handshake succeeds with ECDSA certificate.
Additional findings:
I checked the source code of v1.9.0 and v1.9.1 from GitHub. In SslContext::servername_cb(), the ECDSA context is only selected if F_ECDSA_AVAIL flag is set. This flag is set in select_cert_cb(), which is registered by initSniMultiCert() and enableSelectCertCb(). However, in the published source code, VHostMap::setSslContext() calls initSNI() (not initSniMultiCert()), and enableSelectCertCb() is never called. So it appears select_cert_cb() is not invoked at all.
Could you please clarify:
1. Is sslEnableMultiCerts with RSA+ECDSA supposed to work in OpenLiteSpeed 1.9.0?
2. Why does the installed binary behave differently from the published source code?
3. Is there a known issue or required configuration to make RSA fallback work?
Thank you.
Best regards,
Petr