Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Our application originally used a single Apache server with mod_perl installed to serve up all HTTPS requests. Due to memory issues I've added a lighter Apache installation and used ProxyPass to hand off the Perl requests to the mod_perl enabled server.

We currently have an SSL certificate installed on the mod_perl server but I'm struggling to understand whether we need a certificate for both servers or only the lightweight server which is receiving the original requests. Or can a certificate be used for more than one server on a single machine?

Thanks in advance for any help/pointers.

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

Only the lightweight server needs the certificate, because it is handling the ssl traffic and the client is only communication with this server.

A ssl certificate is normally bound to the fqdn of the server, unless you have a wildcard certificate, like *.example.com. This said, you can use the same certificate for multiple servers on the same machine as long as they all have the name of the cn tag of the certificate. Otherwise you would get an error message in the browser/client, telling you server name and certifiacate name do not match.

share|improve this answer
1  
While using the same SSL certificate on multiple servers will work fine as long as they're using the same domain name, this is a breach of the terms & conditions of most SSL certificate providers (unless you've paid more for multiple servers). It's like software licensing -- you can use the software on more machines than you've licensed, except that it's illegal. –  Mike Scott Jan 4 '11 at 11:51
    
Thanks guys. Presumably in that case I would be ok to point my lightweight server at the existing certificate files and create a new self-signed certificate for my back end server? That would avoid any T&C issues? –  Nick Jan 4 '11 at 13:57
    
You even don't have to create a self signed certificate for your back end server, when the communication channel between the servers can be trusted. I assume the lightweight and back end server are on the same network. –  Christian Jan 5 '11 at 7:16
    
They're on the same machine. Can you start up an SSL server without a certificate? Or do you mean I wouldn't need to run the server as SSL? –  Nick Jan 5 '11 at 8:18
    
You don't have to run the back end server with SSL, just use http. –  Christian Jan 5 '11 at 9:21
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.