Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Our current setup utilizes multiple VPS's along with multiple domains.

ex (And yes I know these IPs are all fake and unusable in reality. All for example..)

alpha.domain.com 66.555.555

beta.domain.com 66.555.554

charlie.domain.com 66.555.555

delta.domain.com 66.555.557

Let's assume the first 3 domains require SSL (https)

There's two challenges I have here. One is multiple domains, the other is multiple IP/servers. (Currently each is on their own server but in theory we could stack multiple IPs onto a single server also..either way same issue I believe..)

What is the best method of certificate for this? if alpha was our primary ecommerce site lets say I would think it should have its own unqiue SSL. But the others are secondary systems which primarily run crons and backend scripts that require Https for interaction. Is it possible to share one cert among multiple domains/servers/ips or is it that we should get a cert for each domain or each ip/server?

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

You could get a UCC cert that lists all those subdomains (as long as they are all under the same domain) and distribute it to all of those machines, or (if you have a lot of them) a wildcard cert for *.(your domain). Either of those can be used on multiple machines. SSL won't care about the IPs at all.

share|improve this answer
    
This........... –  Tatas Jun 13 '11 at 19:42
add comment

If you secondary servers are purely for internal use or usage with the admin team, you could quite easily create your own mini certification authority and make your services trust it, while using a certificate from a more recognised CA for your external site.

Unless you're using Server Name Indication (which I'm not sure all tools support, especially for non-browser clients), you're constrained to one certificate per combination of IP and port. Maybe what's internal doesn't need to run on the standard ports (depending on your environment).

There are also ways to have multiple host names in the same certificate (see this answer to a similar question).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.