SNI Dynamic Certificate : <p>I'm pulling my hair out here. 
Websites like <a href="http://wix.com" rel="noreferrer">wix.com</a>, <a href="http://squarespace.com" rel="noreferrer">squarespace.com</a> ...etc; can generate websites on the fly and still use SSL on every one of the millions of custom domains.</p>

<p>I try to do the same thing, <strong>but I can't figure out how they do it</strong>!?</p>

<p>The logical solution would be on Apache:</p>

<pre><code>&lt;IfModule mod_ssl.c&gt;
            &lt;VirtualHost *:443&gt;
                    ServerAlias *
                    UseCanonicalName Off

                    DocumentRoot /var/www/html

                    SSLEngine on
                    SSLCertificateFile /etc/apache2/ssl/%0/server.crt
                    SSLCertificateKeyFile /etc/apache2/ssl/%0/server.key
            &lt;/VirtualHost&gt;&lt;/IfModule&gt;
</code></pre>

<p>But when I restart apache I get an error: <strong>SSLCertificateFile: file '/etc/apache2/ssl/%0/server.crt' does not exist or is empty</strong></p>

<p>Even when I create a dummy folder /ssl/%0/ with some dummy certificates... it still used the (wrong) dummy certificates.</p>

<p>I know some will get on their high horses and yell that you cannot resolve the server name BEFORE the TLS handshake.
But according to this <a href="https://community.letsencrypt.org/t/apache-module-mod-vhost-alias-le/9476/8" rel="noreferrer">post</a> and other ones: %0 can be resolved with <a href="http://httpd.apache.org/docs/current/mod/mod_vhost_alias.html" rel="noreferrer">mod_vhost_alias</a> because the server name is sent with SNI... </p>

<p>I know this works: a second approach would be to create a virtualhost for every custom domain:</p>

<pre><code>  &lt;VirtualHost *:443&gt;
                    ServerName site111.ca
                    ServerAlias www.site111.ca

                    DocumentRoot /var/www/html

                    SSLEngine on
                    SSLCertificateFile "/var/app/s3/ssl/site111.ca/certificate.crt"
                    SSLCertificateKeyFile "/var/app/s3/ssl/site111.ca/certificate.key"
                    SSLCertificateChainFile "/var/app/s3/ssl/site111.ca/certificate.chain"
            &lt;/VirtualHost&gt;&lt;VirtualHost *:443&gt;
     ServerName site222.ca
         ServerAlias www.site222.ca
     DocumentRoot /var/www/html

      SSLEngine on
      SSLCertificateFile "/var/app/s3/ssl/site222.ca/certificate.crt"
      SSLCertificateKeyFile "/var/app/s3/ssl/site222.ca/certificate.key"
      SSLCertificateChainFile "/var/app/s3/ssl/site222.ca/certificate.chain"
</code></pre>

<p></p>

<p>I could create a dirty system where I add one virtual host per new domain and reload apache every day Eeewwww... and again: Apache cap the number of virtual hosts to 256 :/</p>

<p>How do they do it!? Is there other technology that can help me? Nginx, Nodejs?
Thank you for your time.</p>
