diff --git a/ssl/provision_ssl.drush.inc b/ssl/provision_ssl.drush.inc
index 01846e5..a5e259b 100644
--- a/ssl/provision_ssl.drush.inc
+++ b/ssl/provision_ssl.drush.inc
@@ -18,6 +18,8 @@
  *
  * php_value session.cookie_secure 1
  * SSLEngine On
+ * SSLCertificateFile $AEGIR_HOME/config/ssl.d/<cert>.pem
+ * SSLCertificateKeyFile $AEGIR_HOME/config/ssl.d/<cert>.key
  */
 function provision_ssl_provision_apache_vhost_config($url, $options) {
   if (!empty($options['ssl'])) {
@@ -31,10 +33,15 @@ function provision_ssl_provision_apache_vhost_config($url, $options) {
       $newoptions['site_port'] = 80;
       provision_write_config(drush_get_option('vhost_path') . '/' . $url . '_80', _provision_apache_redirect_template(), $newoptions);
     }
-    $newoptions = $options;
-    $newoptions['site_port'] = 443;
-    $newoptions['extra_config'] = "php_value session.cookie_secure 1\nSSLEngine On\n";
-    provision_write_config(drush_get_option('vhost_path') . '/' . $url .  '_443', _provision_apache_default_template(), $newoptions);
+    else {
+      // enable default port 80 if there's no redirect
+      // make sure that http and https work simultaneously
+      $newoptions = $options;
+      $newoptions['site_port'] = 80;
+      provision_write_config(drush_get_option('vhost_path') . '/' . $url . '_80', _provision_apache_default_template(), $newoptions);
+    }
+
+    return _provision_ssl_generate_ssl_vhost_extra($url, $options);
   }
   return NULL;
 }
@@ -42,10 +49,37 @@ function provision_ssl_provision_apache_vhost_config($url, $options) {
 /**
  * Implementation of hook_provision_apache_delete_vhost()
  *
- * This will delete the redirection vhost if it was created.
+ * This will delete any vhost created in conjunction with the ssl vhost.
  */
 function provision_ssl_provision_apache_delete_vhost($url, $options) {
-  if ($options['ssl'] && $options['ssl_redirect']) {
+  if ($options['ssl']) {
     provision_path('unlink', drush_get_option('vhost_path') . '/' . $url . '_80', TRUE, NULL, dt("Failed deleting redirection vhost."));
   }
 }
+
+/**
+ * Add additional SSL directives to vhost extra_config.
+ */
+function _provision_ssl_generate_ssl_vhost_extra($url, $options) {
+  if (!$options['ssl_wildcard']) {
+    // use individual certificates per site
+    if (file_exists($options['site_certificate_file']) && file_exists($options['site_certificate_key'])) {
+      $lines = array("php_value session.cookie_secure 1", "SSLEngine On");
+      $lines[] = "SSLCertificateFile {$options['site_certificate_file']}";
+      $lines[] = "SSLCertificateKeyFile {$options['site_certificate_key']}";
+    } else {
+      drush_set_error(dt('SSL Certificate'), dt("cannot find site-specifoc SSL certificates %cert or %key", array('%cert' => $options['site_certificate_file'], '%key' => $options['site_certificate_key'])));
+    }
+  }
+  else {
+    // use the server-wide certificate
+    if (file_exists($options['server_certificate_file']) && file_exists($options['server_certificate_key'])) {
+      $lines = array("php_value session.cookie_secure 1", "SSLEngine On");
+      $lines[] = "SSLCertificateFile {$options['server_certificate_file']}";
+      $lines[] = "SSLCertificateKeyFile {$options['server_certificate_key']}";
+    } else {
+      drush_set_error(dt('SSL Certificate'), dt("cannot find server-wide SSL certificates %cert or %key", array('%cert' => $options['server_certificate_file'], '%key' => $options['server_certificate_key'])));
+    }
+  }
+  return $lines;
+}
\ No newline at end of file
diff --git a/ssl/verify.provision.inc b/ssl/verify.provision.inc
index 626eb34..66d541d 100644
--- a/ssl/verify.provision.inc
+++ b/ssl/verify.provision.inc
@@ -5,5 +5,6 @@
 function drush_provision_ssl_post_provision_verify($url = NULL) {
   if (PROVISION_CONTEXT_SITE) {
     drush_set_option('ssl', drush_get_option('ssl'), 'site');
+    drush_set_option('ssl_wildcard', drush_get_option('ssl_wildcard'), 'site');
   }
 }
diff --git a/web_server/provision_apache_server.tpl.php b/web_server/provision_apache_server.tpl.php
index fbd81b8..57cc70e 100644
--- a/web_server/provision_apache_server.tpl.php
+++ b/web_server/provision_apache_server.tpl.php
@@ -5,6 +5,13 @@
   NameVirtualHost *:<?php print $web_port; ?>
 
   <VirtualHost *:<?php print $web_port; ?>>
+    <?php if ($web_port == '443'): ?>
+    SSLEngine On
+    SSLCertificateFile <?php print $server_certificate_file; ?>
+
+    SSLCertificateKeyFile <?php print $server_certificate_key; ?>
+
+    <?php endif; ?>
     ServerName default
     Redirect 404 /
   </VirtualHost>