Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two servers working in a multi-master mirror mode OpenLDAP setup., and is a floating virtual IP that associates itself on the interface of the active node (server-0 or server-1), a rather common setup.

the problem is, I created some self signed certificates with a CA on server-0. what is the distribution of ssl client/server certificates that needs to happen for the two servers to speak to each other, and more importantly, for clients to speak to

simply copy/pasting configs doesn't seem to be the answer, especially since the common name on the servers is unique, they each have different host names.

also, if server-0 goes down, and server-vip points at server-1, how are clients supposed to transparently work in as far as SSL goes if they have a client certificate for server-0?

share|improve this question
up vote 1 down vote accepted

You can create a single certificate with multiple subjectAltNames that will be valid for all hostnames listed. Personally, rather than use self-signed certs I prefer to run a private CA using the OpenVPN easy-rsa scripts, for which there's a patch for subjectAltName support.

share|improve this answer
This is a reasonable solution, but be aware that this requires your clients / SSL libraries to understand subjectAltName. "Try it and see" :-) – voretaq7 Feb 5 '10 at 18:04

you should create three certificates:

  • one for server-0
  • one for server-1
  • one for server-vip

give the server-vip certificate to your clients as trusted certificate. server-0 must have the certificate of server-1 as trusted and vice versa.

this way your clients won't recognize a failover and your servers are independent of the server-vip certificate.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.