Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Win 2008 R2 server running on AWS EC2 and need the ability to VPN to it. PPTP isn't an option given EC2 firewall restrictions (no GRE routing).

I am planning to setup SSTP and it is my understanding that a self-signed cert is not an option.

So

  1. Will one of Godaddy's "Standard" SSL certs work for SSTP? (Only $13. I am the only person connecting to this via Win7.)

  2. Can I buy a wildcard cert or does it need to be host specific? (*.mydomain.com vs bla.mydomain.com)

  3. Any other considerations?

share|improve this question
    
Do you have a source for your belief that you cannot use a self-signed certificate? I can't find anything to corroborate that, nor have I ever encountered an SSL-based technology that wouldn't allow a self-signed certificate. –  Joel E Salas Feb 10 '12 at 0:13
    
I haven't used SSTP, but this article seems to indicate a self-signed cert is possible. artisticcheese.blogspot.com/2009/04/… Even if it isn't possible, that doesn't mean you have to pay for the cert, you could almost certainly setup a CA using one of many OpenSSL based tools. –  Zoredache Feb 10 '12 at 1:08

1 Answer 1

up vote 2 down vote accepted

Yes it can be wildcard.

The server and the client both have to trust the issuing root, so you could use a free CACert and add the root to server and client (as a trusted root in Computer Certificate store), or the Godaddy route is fine too.

share|improve this answer
1  
Finally got it all working and it does work with a self signed cert. The key was specifying the correct cert from RRAS via server properties. –  andleer Feb 12 '12 at 4:41
    
Great. I'm assuming you copied the server self-signed cert to the client's trusted roots? –  Bret Fisher Feb 14 '12 at 0:47
    
Bret, yes, copied the server self signed cert back to the client. –  andleer Feb 14 '12 at 4:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.