Proposal: multiple certificates deployment for a single domain #1159
Description
Background
As is known to all, ECC (Elliptic Curve Cryptography) certificate has several advantages than RSA certificate, like smaller key size. The speed of SSL handshake on the server side will be better if we can use the ECC certificate.
Nevertheless, some browsers may not recognize the ECC certificate, so if someone migrated his/her certificate from RSA to ECC, compatibility broken might occur.
Solution
Let's try to deploy multiple certificates for a single domain, depending on the cipher suites that client sent, apisix can select and send the most appropriate certificates.
Technically, OpenSSL's related APIs like SSL_use_certificate, SSL_use_PrivateKey, can be called duplicately for a single SSL session, the certificate selection will be done under the hood.