two sites can take the same server IP for SSL

Okay, this is a hairy one, and hard to reproduce, but I was able to do it while trying to reproduce #993944: ssl rollback failure.

I have now the following sites:

aegir@marcos:~/config/server_master/apache/vhost.d$ grep '<VirtualHost' * | grep 443
test2.orangeseeds.org:  <VirtualHost 192.168.0.3:443>
test3.orangeseeds.org:  <VirtualHost 192.168.0.3:443>
test4.orangeseeds.org:  <VirtualHost 127.0.0.2:443>
test5.orangeseeds.org:  <VirtualHost 127.0.0.3:443>

test2 and test3 were created in the same queue dispatch, and they have the same IP. That IP is listed only *once* in the server though, so that shouldn't be possible. Here are the certificates used:

test2.orangeseeds.org:    SSLCertificateFile /var/aegir/config/server_master/ssl.d/orangeseeds.org/openssl.crt
test3.orangeseeds.org:    SSLCertificateFile /var/aegir/config/server_master/ssl.d/test3.orangeseeds.org/openssl.crt
test4.orangeseeds.org:    SSLCertificateFile /var/aegir/config/server_master/ssl.d/test4.orangeseeds.org/openssl.crt
test5.orangeseeds.org:    SSLCertificateFile /var/aegir/config/server_master/ssl.d/test5.orangeseeds.org/openssl.crt

The frontend agrees that both sites have the same IP. To quote the issue i'm from:

The other problem is that the way the IP is taken is non-atomic - we glob for the pattern (using get_certificate_ip()) and then if it's "okay", we touch a file (in get_ip_certificate(), to avoid any confusion ;). Those two functions should at least be merged so that the lock file would be created in exclusive mode (which fails if the file exists).

So this is really about making that IP allocation atomic, I believe.

(What's odd about all this is that I don't think we are still running the queue in parallel - are we?)