Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Our main site www.example.com has a regular VeriSign SSL certificate. However, we need ssl for our dev environment for accurate testing. Is it possible to use another ssl from a different (cheaper) provider for our dev.example.com and stage.example.com domains? We have a load balancer with different ip's so having unique IP's should not be an issue.

share|improve this question
    
You want to host prod, dev and staging on the same machine? o_O –  Mathias R. Jessen Apr 3 '12 at 23:03
    
well no, they are on separate machines, but we have our analytics.example.com and other similarly named applications on the same machine. –  SirrDon Apr 3 '12 at 23:08
add comment

2 Answers 2

up vote 5 down vote accepted

Yes

It is most certainly possible. I've worked with a few companies who buy expensive certificates (eg. Extended Validation certificates) for production sites, and cheaper certificates (Domain Validated certificates), sometimes from different Certificate Authorities, for development and testing purposes.

That being said, you might want to approach this a little differently though, especially when considering an "accurate testing" motive

First of all, SSL certificates primarily provide 3 things:

  1. Encryption
  2. Integrity
  3. Authenticity

The first feature, encryption, is provided no matter what CA you choose. A 2048-bit CSR signed by DigiSign provides just as strong encryption as a 2048-bit CSR signed by VeriSign.

The second feature, integrity, lies in the nature of the connection, that is: an encrypted message exchange between a client and a trusted server. So without the confidence in the Encryption and Authenticity, integrity of the message exchange cannot be achieved. Furthermore a message digest is calculated to ensure that the message is the same before encryption and after decryption

The third feature, authenticity, is determined by the trust relationship between the CA that issued your SSL certificate (eg. VeriSign), and the user (the client). This is important, because client software might trust one CA but not another. An example might be: testing a secure web application on a mobile device. The mobile device trusts the CA that issued your "test"-certificate, but as soon as you go into production everything breaks, because the CA that issued your production certificate is not trusted by the mobile device.

A possible solution (and one that I would often recommend), is the use of wildcard certificates, a certificate that matches a wildcard subdomain component, like: *.example.com. This way you can secure www.example.com, analytics.example.com, dev.analytics.com etc., all with the same certificate.

Wildcard certificates are pretty expensive, but if you have a handful of sites or more, it might be worth your while

share|improve this answer
1  
Great notes! Don't overlook self-signed certificates in IIS7 as the cheapest means of adding SSLs to development & staging sites for testing! –  Chris Anton Apr 3 '12 at 23:41
    
@ChrisAnton if the technical part (encryption), is the only worry, then yeah, self-signed certificates is without doubt the cheapest option :-) –  Mathias R. Jessen Apr 3 '12 at 23:46
    
@ChrisAnton: You can get free Class 1 SSL certificates at StartSLL, and they are recognised by all major browsers. –  paradroid Apr 3 '12 at 23:55
add comment

It will depend on your LB config and your webserver choice and config but yes it should be possible to have different certificates on each subdomain.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.