up vote 0 down vote favorite
share [g+] share [fb]

I have godaddy 5 subdomains certificate. Currently its used for site1.mysite.com. I have CNAME DNS record that directs site2.mysite.com to another server (on another HOST). can I use the certificate from Godaddy for site2.mysite.com? Or I have to buy another certificate for another IP address?

I have issued certificate request for site2.mysite.com from godaddy but it seems to not want new certificate data but just allows site2 with all the data I setup when registering mysite.com certificate.

link|improve this question
79% accept rate
do you have a wildcard certificate (*.mysite.com) or do you only have a certificate for site1.mysite.com? – Christian Jan 10 '10 at 15:12
feedback

2 Answers

up vote 3 down vote accepted

If you've got both halves of the certificate there's no technical reason why you can't install the SSL cert on multiple servers.

However doing so may be against the terms of sale of the SSL certificate, so check your contract.

My own previous experience is with Thawte / Verisign, whose standard pricing only allows you to install a certificate on a single server. If you've got a load-balanced cluster they require you to purchase an additional "license" for each additional server in the cluster.

FWIW, in my humble opinion, etc, applying a license-like model against a piece of data like this is tantamount to extortion...

link|improve this answer
Disagree about the "license" comparison. When you buy a cert you get a piece of data. But the cert issuer has to maintain infrastructure to verify the cert when someone hits your site. There is ongoing expense, and the renewals support that. – tomjedrz Jan 10 '10 at 16:15
the cert issuer only has to provide infrastructure if they're offering online revocation (e.g. OCSP). Normal validation requires no such infrastructure - all of the required information is within the cert. – Alnitak Jan 10 '10 at 18:11
And if a CA is not providing revocation checking (preferably OCSP) you shouldn't really be buying anything from them... Those things are there for a reason -- to make it possible to revoke compromised certificates. – Ivan Ristic Jan 17 '10 at 0:21
feedback
up vote 0 down vote

Your server certificate hostname has to match what the client expects it to be. If your server certificate says site1.mysite.com and the client tries to dereference site2.mysite.com, the client will report a problem even if DNS directs that to site1.mysite.com.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.