Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Windows Server 2008 machine that is hosting two of my websites. I want do not want my users passwords to be sent in clear text. From my understanding, to address this, I need to use HTTPS. HTTPS is available once I install an SSL certificate. I have several questions:

  1. Does SSL get installed per domain, or per server? If it is per server, can I use the same SSL certificate for both of my sites?
  2. Is the SSL certificate portable? In other words, if I choose to move servers, is there a way to move the certificate to a new server?
  3. Is there a way for me to test https on my local development machine?
  4. Currently, I navigate to my pages relatively. Would this be affected if HTTPS is used?

Thank you!

share|improve this question
add comment

1 Answer

  1. Does SSL get installed per domain, or per server? If it is per server, can I use the same SSL certificate for both of my sites?

Depends on the restrictions imposed by the certificate authority/reseller, but it's usually per-domain because of what you use in the Common Name (CN) needs to match the site's domain and if both are different, you can't use the same certificate, or it'll throw an error on the user's browser about a certificate mismatch. There is also Subject Alternative Name (SAN) certificates that allow you to protect multiple domains (where wildcards will do multiple sub-domains i.e. *.example.com) and they will work in most browsers and mobile devices, but they're more expensive generally. Another problem is with virtual servers and SSL don't get along, so unless you want to host the second site on a different SSL port, you need another IP address (and another static public WAN IP as well for DNAT if your IIS server is behind a firewall), or you need to use the same certificate for all sites with a SAN certificate and configure SSL Host Headers in IIS.

  1. Is the SSL certificate portable? In other words, if I choose to move servers, is there a way to move the certificate to a new server?

Yes, you need to export the private key from the server.

  1. Is there a way for me to test https on my local development machine?

Sure, you can just install a self-signed certificate. The IIS Resource Kit comes with a tool to generate a self-signed certificate; I believe IIS 7 has one built-in (but only allows for a certificate with an expiry of one year).

  1. Currently, I navigate to my pages relatively. Would this be affected if HTTPS is used?

No, only absolute paths (i.e. <img src="http://www.example.com/img/img.jpg" /> in an otherwise SSL enabled site would pop up with a warning that not all objects are encrypted on the page.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.