up vote 0 down vote favorite
share [g+] share [fb]

I have a SSL-Certificate by COMODO for example.com Now I have 3 role-based servers with 3 different IP's (web/smtp/pop3) Can I use the same SSL-Certificate for 3 different services on 3 different IP's? Thx

link|improve this question
feedback

2 Answers

up vote 1 down vote

Problem here would be that you cant have one name to resolve to 3 different IPs

Unless you have wildcard certificate for *.example.com your certificate for example.com will be working properly on just one IP.

When you want to access example.com, DNS will tell you one IP, or if you put moe than 1 entry for that name you cant be sure which answer you will get by round-robin.

link|improve this answer
I want to access different services (ports!) imap, smtp, pop3 - I dont want to host same webserver with the same certificate. – Phoibe Feb 17 '11 at 18:47
I understand you, but what I'm telling you is say ip for imap.example.com 10.10.10.2 ; smtp.example.com 10.10.10.3 ; www.example.com 10.10.10.4 ; and now you put same ssl certificate for imap/smtp/www unless it's *.example.com certificate you will get errors because FQDN does not match CN (canonical name) in certificate. – Hrvoje Špoljar Feb 17 '11 at 18:53
feedback
up vote 0 down vote

Yes you can use the certificate for multiple IP's / services on a server, SSL certificates are bound by a "CommonName", which is the hostname for HTTP.

link|improve this answer
I use Debian. Where do I set the CommonName? **which is the hostname for HTTP". I have DNS pointing http to ip 1, smpt is ip 2 and pop3 is ip 3. – Phoibe Feb 17 '11 at 17:51
example.com is the CommonName in your case. You cannot set the CommonName yourself. When you request a SSL certificate at Comodo, you'll be asked for the domain name, which is the CommonName. Are you having problems with adding the SSL cert to your web/smtp/pop3 server? – Lekensteyn Feb 17 '11 at 17:58
No I try to understand how to solve that technically. I have my CommonName = example.com - now I want to install this certificate on a server which handles pop3 - ip 1.1.1.1 - the dns entry for www is 2.2.2.2 and for smtp is 3.3.3.3 - is it possible to use one certificate with those 3 servers? (no wildcard cert) – Phoibe Feb 17 '11 at 18:49
1  
@Phoibe: The IP has nothing to do with it. The client will connect to "www.example.com" and look at the cert that says "example.com" and say "this is wrong" because "www.example.com"!="example.com". Same with "pop3.example.com" and "smtp.example.com" – DerfK Feb 17 '11 at 18:52
@Phoibe, DerfK explained it all. It's not uncommon that SSL certs are shared among multiple machines (with different IP addresses). – Lekensteyn Feb 17 '11 at 18:59
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.