Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 7 down vote favorite

Are there any technical/legal/contractual limitations to using a CA certificate on multiple sites that are running on a

single machine?

multiple machines?

Or are the certificates to be used on a per site basis?

share|improve this question

3 Answers

up vote 10 down vote accepted

You can have a certificate on multiple machines. But unless the "site name" for all the machines is the same (eg a cluster of web servers all serving for one website) your users will get a mismatch error as the certificate wont match the server name they requested.

You can have a certificate on a single machine with multiple sites (eg virtual hosting) but you will have the same problem as above.

If you are serving multiple "sites" from a single server and want users web browsers and the like to be happy you will need multiple certificates and multiple IP addresses assigned to the host. This is because it is the connection that is certified and encrypted and this happens before the client tells you what site it is interested. This is the limitation of the current SSL protocol. This limitation is addressed in the latest protocol but not everything supports that yet.

share|improve this answer
Thanks Vagnerr, so I guess it's more closely tied to the site than I was hoping. In any case, it definitely helps in clearing all these things up! – Joseph Apr 30 '09 at 17:00
+1. Much more authoritative (and accurate) than my answer. I'll delete my answer rather than fix it as I have nothing to add to your answer. – Eddie Apr 30 '09 at 17:03
Yup. A trusted (CA issued) certificate is tied to a particular site (or set of sites). This is, in fact, the POINT of having a CA issued certificate in the first place, since otherwise a man-in-the-middle attack could compromise DNS and serve up fraudulent data over SSL without the end-user being aware. – Wedge Apr 30 '09 at 19:57
up vote 1 down vote

I found an answer on Verisign here that stipulates that a single cert can not be used on multiple servers without having a special license, which answers my multiple question.

I'm assuming this means there's no issue using it on multiple sites as long as they are all on a single machine.

This might also be specific to the CA.

share|improve this answer
up vote 1 down vote

You can use a Unified Communications Certificate. It allow you to add multiple Subject Alternative Names on the certificate. You can install this certificate on multiple servers for multiple domain names. You could have one certificate for:

server1.blah.com

server2.blah.com

www.blah.com

www.notblah.com

They were originally introduced for use with Exchange 2007 and Communication Server, but can be used for other servers. More info from a ssl cert vendor:

Digicert uc ssl cert page

Entrust uc ssl cert page

There are also wildcard certs, but I know less about those, they may work for your purposes also.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.