Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have godaddy 5 subdomains certificate. Currently its used for site1.mysite.com. I have CNAME DNS record that directs site2.mysite.com to another server (on another HOST). can I use the certificate from Godaddy for site2.mysite.com? Or I have to buy another certificate for another IP address?

I have issued certificate request for site2.mysite.com from godaddy but it seems to not want new certificate data but just allows site2 with all the data I setup when registering mysite.com certificate.

share|improve this question
    
do you have a wildcard certificate (*.mysite.com) or do you only have a certificate for site1.mysite.com? –  Christian Jan 10 '10 at 15:12

2 Answers 2

up vote 3 down vote accepted

If you've got both halves of the certificate there's no technical reason why you can't install the SSL cert on multiple servers.

However doing so may be against the terms of sale of the SSL certificate, so check your contract.

My own previous experience is with Thawte / Verisign, whose standard pricing only allows you to install a certificate on a single server. If you've got a load-balanced cluster they require you to purchase an additional "license" for each additional server in the cluster.

FWIW, in my humble opinion, etc, applying a license-like model against a piece of data like this is tantamount to extortion...

share|improve this answer
    
Disagree about the "license" comparison. When you buy a cert you get a piece of data. But the cert issuer has to maintain infrastructure to verify the cert when someone hits your site. There is ongoing expense, and the renewals support that. –  tomjedrz Jan 10 '10 at 16:15
    
the cert issuer only has to provide infrastructure if they're offering online revocation (e.g. OCSP). Normal validation requires no such infrastructure - all of the required information is within the cert. –  Alnitak Jan 10 '10 at 18:11
    
And if a CA is not providing revocation checking (preferably OCSP) you shouldn't really be buying anything from them... Those things are there for a reason -- to make it possible to revoke compromised certificates. –  Ivan Ristic Jan 17 '10 at 0:21

Your server certificate hostname has to match what the client expects it to be. If your server certificate says site1.mysite.com and the client tries to dereference site2.mysite.com, the client will report a problem even if DNS directs that to site1.mysite.com.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.