Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Hopefully a very simple question, if I wanted several servers providing the same service to hold a certificate (e.g interface.internal.org) would the procedure be;

  • Generate Public/Private Pair on one web server
  • Generate CSR and receive Certificate
  • Copy Private/Public Key Pair and Certificate to each server

Although there is the potential to place certificates at the load balancing layer, I wanted to investigate other ways - plus the servers have SSL accelerators so performance isn't really a factor.

Regards,

Tom

share|improve this question
    
Cheers for the sanity check people, I thought it was possible! –  Tom Werner Feb 22 '10 at 21:50

3 Answers 3

up vote 3 down vote accepted

Your procedure as indicated above should work

share|improve this answer

Yes your procedure will work. If you are using a commercial SSL cert provider, check if you need to pay for additional licences for each extra cluster node. This is the case with Thawte, for example. If using internally generated certsthen this won't be an issue.

share|improve this answer
    
The certificate licensing is a worthy note, thankfully my chosen supplier allows deployment throughout a network. –  Tom Werner Feb 22 '10 at 21:52

That will work with apache, but IIS generates its own CSR for each server. Just watch out for that.

share|improve this answer
    
Cheers, thanks for the heads up, thankfully I am using OAS (Apache based I believe) –  Tom Werner Feb 22 '10 at 21:44
    
You can generate a single request, get the cert and install it, then export the key\cert pair and put it on the other servers. Provided you haven't flagged it as non exportable in the first place (or don't want to resort to hacking) –  Helvick Feb 22 '10 at 22:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.