Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an application which exposes multiple WCF services (each a distinct facade for different client applications). Right now I'm managing a distinct certificate (created from our internal certificate server) per service (and I do this for multiple environments, e.g. dev, qa, staging, prod).

MSDN seems to suggest that this certificate is not only used for encrypting communications but also to "authenticate the service to clients", suggesting distinct certificates should be used so that one service is distinguished from another, even on the same server. However, I feel like I could "cheat" and use the same certificate (at least per environment) on all of the services -- essentially an application-level certificate. It would still ensure the services are from the proper application.

So how much of a "cheat" is this? Am I bending the rules too far? Obviously, it's my application and my services, so I'm free to do what I want -- but I want to keep from coloring too far outside the lines.

share|improve this question
Got a response on StackOverflow: – Trinition Mar 21 '13 at 19:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.