0

I have a SSL-Certificate by COMODO for example.com Now I have 3 role-based servers with 3 different IP's (web/smtp/pop3) Can I use the same SSL-Certificate for 3 different services on 3 different IP's? Thx

Improve this question

2 Answers 2

Reset to default
2

Problem here would be that you cant have one name to resolve to 3 different IPs

Unless you have wildcard certificate for *.example.com your certificate for example.com will be working properly on just one IP.

When you want to access example.com, DNS will tell you one IP, or if you put moe than 1 entry for that name you cant be sure which answer you will get by round-robin.

Improve this answer
2
  • I want to access different services (ports!) imap, smtp, pop3 - I dont want to host same webserver with the same certificate.
    – Phoibe
    Feb 17, 2011 at 18:47
  • 1
    I understand you, but what I'm telling you is say ip for imap.example.com 10.10.10.2 ; smtp.example.com 10.10.10.3 ; www.example.com 10.10.10.4 ; and now you put same ssl certificate for imap/smtp/www unless it's *.example.com certificate you will get errors because FQDN does not match CN (canonical name) in certificate.
    – Hrvoje Špoljar
    Feb 17, 2011 at 18:53
0

Yes you can use the certificate for multiple IP's / services on a server, SSL certificates are bound by a "CommonName", which is the hostname for HTTP.

Improve this answer
5
  • I use Debian. Where do I set the CommonName? **which is the hostname for HTTP". I have DNS pointing http to ip 1, smpt is ip 2 and pop3 is ip 3.
    – Phoibe
    Feb 17, 2011 at 17:51
  • example.com is the CommonName in your case. You cannot set the CommonName yourself. When you request a SSL certificate at Comodo, you'll be asked for the domain name, which is the CommonName. Are you having problems with adding the SSL cert to your web/smtp/pop3 server?
    – Lekensteyn
    Feb 17, 2011 at 17:58
  • No I try to understand how to solve that technically. I have my CommonName = example.com - now I want to install this certificate on a server which handles pop3 - ip 1.1.1.1 - the dns entry for www is 2.2.2.2 and for smtp is 3.3.3.3 - is it possible to use one certificate with those 3 servers? (no wildcard cert)
    – Phoibe
    Feb 17, 2011 at 18:49
  • 1
    @Phoibe: The IP has nothing to do with it. The client will connect to "www.example.com" and look at the cert that says "example.com" and say "this is wrong" because "www.example.com"!="example.com". Same with "pop3.example.com" and "smtp.example.com"
    – DerfK
    Feb 17, 2011 at 18:52
  • @Phoibe, DerfK explained it all. It's not uncommon that SSL certs are shared among multiple machines (with different IP addresses).
    – Lekensteyn
    Feb 17, 2011 at 18:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .