Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are looking to set up a service where multiple boxes, in different data centers, would allow HTTPS access. We are looking to set to buy a wildcard SSL cert to handle any number of vanity sub domains.

We are primarily looking at goDaddy's wildcard SSL cert. Has anyone set up anything similar to this? We have looked at Digicert's offering but we want to look for cheaper options.

share|improve this question

closed as not constructive by Chris S Aug 21 '12 at 18:15

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
Certs aren't tied to servers, what you do with them is your own business (within reason). –  Chris S Nov 29 '11 at 0:46
1  
Believe it or not, there are CAs that make you execute a licensing agreement that limits the number of servers you can use the certificate on. Strange but true. –  David Schwartz Feb 1 '12 at 7:20
add comment

6 Answers

up vote 3 down vote accepted

We use GoDaddy's wild card certs for most of our sites. All our sites are hosted by multiple servers. After you install the cert on the server that creates the CSR export the cert to a PFX file and import it to the other server. The clients won't know the difference.

GoDaddy knows we do this, and they haven't ever questioned us about it.

share|improve this answer
1  
I'm not sure what you're implying here; certs+key are not linked to a server (unlike, say, ssh's known_hosts+server keys) but to a domain name and possibly IP. Needless to say, if said domain name is served by 100 servers, each of them gets a copy of the private key. –  niXar Aug 7 '09 at 1:30
    
or just the proxy/load-balancer gets the private key and the 100 servers behind it can be just http –  djangofan Nov 29 '11 at 0:12
add comment

http://www.digicert.com has very flexible licensing including unlimited installs within your domain for UC and Wildcards. We use their UC on Exchange and are shifting from Verisign and Thawte to Digicert for other systems as well due to both the pricing and license flexibility. They also provide a 30 day trial, in which they issue a certificate that has a 30 day validity period, for testing with your systems. So far they've been great for us.

share|improve this answer
1  
+1 for Digicert! They've been great to us as well; very professional, excellent technical support, reasonable pricing, and flexible licensing. UCC certs are are useful in many circumstances, not just Exchange 2007, and can be more cost-effective than wildcard certs in most instances. Even their standard certs utilize the Subject Alternate Name field to protect both www.example.com and example.com with a single cert (and license fee). –  jnaab Sep 11 '09 at 6:16
    
+1 Digicert - they are a great company to work with. They're really flexible and helpful on working with you to make sure your cert problems are solved, and really good on fees in my book. –  RobM Oct 5 '10 at 11:09
    
+1 Digicert - I've had nothing but excellent support from DigiCert. They're really on the ball. –  saturdayplace Oct 18 '11 at 23:29
add comment

You can create your own wildcard cert also. You don't get the "brand name" and insurance that goes along with it, but its just as secure. If the SSL connections aren't used by the general public, and only for your own use, i'd recommend that to save money.

Here is a rough draft of the process (using a Keystore) that you have to hack for your own use. You'd have to learn how to do it yourself using the following as a "hint" :

:: create authority
openssl req -config %OPENSSL_HOME%\openssl.cfg -new -x509 -extensions v3_ca -keyout %OPENSSL_HOME%\..\demoCA\private\cakey.pem -out %OPENSSL_HOME%\..\demoCA\cacert.pem -days 1096

:: create wildcard cert in keystore, cn name *.site.com 
keytool -genkey -alias wildcard -keyalg RSA -keystore %OPENSSL_HOME%\..\myCerts\keystore.kdb

:: generate CSR
keytool -certreq -alias wildcard -keystore %OPENSSL_HOME%\..\myCerts\keystore.kdb -file %OPENSSL_HOME%\..\myCerts\wildcard.csr

:: import CA from previous step into keystore
keytool -import -alias root -keystore %OPENSSL_HOME%\..\myCerts\keystore.kdb -trustcacerts -file %OPENSSL_HOME%\..\demoCA\cacert.pem

:: sign CSR with CA and convert to DER format
openssl ca -config %OPENSSL_HOME%\openssl.cfg -policy policy_anything -out %OPENSSL_HOME%\..\myCerts\wildcard.crt -infiles %OPENSSL_HOME%\..\myCerts\wildcard.csr
openssl x509 -in %OPENSSL_HOME%\..\myCerts\wildcard.crt -inform PEM -out %OPENSSL_HOME%\..\myCerts\wildcard.der -outform DER

:: import chain of wildcard cert
keytool -import -alias wildcard -keystore %OPENSSL_HOME%\..\myCerts\keystore.kdb -trustcacerts -file %OPENSSL_HOME%\..\myCerts\wildcard.der
share|improve this answer
add comment

SSL certificates are issued based upon their domain, rather than which server hosts them. All that matters from a client's perspective is that the domain used to access the certificate matches the domain on the certificate itself.

For your needs, I expect any wildcard certificate should work. I'd be interested to see if anyone can provide evidence to the contrary?

share|improve this answer
1  
Not all SSL vendors have the same policies, for instance "Comodo Premium Wildcard" certs have an extra fee per server you want to install the cert on. –  Ambirex Aug 6 '09 at 17:46
4  
You are correct; there are no technical limitations preventing the installation / use of a wildcard cert on multiple hosts. It is, however, a violation of the contract with the SSL vendor in almost all cases. I know I've encountered a couple that do explicitly allow installing the cert on multiple hosts, but unfortunately I can't remember which ones... –  Insyte Aug 6 '09 at 19:17
    
Interesting; didn't know about this. That's a bizarre requirement. –  niXar Aug 7 '09 at 1:31
1  
Just a follow up, we had contacted goDaddy and they said they support wildcards on multiple servers. So that is the direction we went. Thank you all. –  Ambirex Aug 20 '09 at 23:17
    
It is a money thing, Veri$ign makes big profits selling the same tiny file to you multiple times. –  Walter Sep 22 '09 at 6:59
show 1 more comment

The cheapest one I have found is the one from StartSSL. They only charge for yearly verification and you can have as many wildcard certificates for different domains as you want.

share|improve this answer
    
Important caveat: This method requires that you be the owner of your mail server, or at least have the authority in your company to request that emails to admin@mail.mycompany.com be forwarded to yourself. So, if you can afford a domain name and mail server, then this is a lot cheaper than other SSL alternatives. –  djangofan Nov 29 '11 at 0:14
add comment

Maybe a bit too late, but "GlobalSign SSL Certificates are provided with licensing for an unlimited number of servers included in the standard price."

share|improve this answer
1  
At over $500/year even with all discounts, that's not a very good deal. –  David Schwartz Aug 28 '11 at 10:45
add comment

protected by Iain Nov 12 '12 at 7:28

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.