Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Our current setup utilizes multiple VPS's along with multiple domains.

ex (And yes I know these IPs are all fake and unusable in reality. All for example..) 66.555.555 66.555.554 66.555.555 66.555.557

Let's assume the first 3 domains require SSL (https)

There's two challenges I have here. One is multiple domains, the other is multiple IP/servers. (Currently each is on their own server but in theory we could stack multiple IPs onto a single server also..either way same issue I believe..)

What is the best method of certificate for this? if alpha was our primary ecommerce site lets say I would think it should have its own unqiue SSL. But the others are secondary systems which primarily run crons and backend scripts that require Https for interaction. Is it possible to share one cert among multiple domains/servers/ips or is it that we should get a cert for each domain or each ip/server?

share|improve this question
up vote 3 down vote accepted

You could get a UCC cert that lists all those subdomains (as long as they are all under the same domain) and distribute it to all of those machines, or (if you have a lot of them) a wildcard cert for *.(your domain). Either of those can be used on multiple machines. SSL won't care about the IPs at all.

share|improve this answer
This........... – Tatas Jun 13 '11 at 19:42

If you secondary servers are purely for internal use or usage with the admin team, you could quite easily create your own mini certification authority and make your services trust it, while using a certificate from a more recognised CA for your external site.

Unless you're using Server Name Indication (which I'm not sure all tools support, especially for non-browser clients), you're constrained to one certificate per combination of IP and port. Maybe what's internal doesn't need to run on the standard ports (depending on your environment).

There are also ways to have multiple host names in the same certificate (see this answer to a similar question).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.