Same SSL Cert for VSFTPD and Apache?

Question

Sorry if this is a real newb question, but is it possible/good practice to use the same SSL certificate for two different daemons? I have VSFTPD running which I want to setup to run with FTPS. I already have an SSL cert which I'm using to protect phpmyadmin over Apache and wondered if I could just use the same certificate (I assume the domain would have to be the same).

Any thoughts on this are appreciated.

Thanks very much,

James.

Answer 1

Yes, it can be done as the two services are listening on different ports.

I'm not familiar with the specifics of doing so with either VSFTPD or Apache though sorry.

You just have to ensure both VSFTPD and Apache are using the same private key as well as the cert itself (and potentially any intermediate root certs that come in to play with your SSL certificate - if you didn't need to install one for apache, you shouldn't need to for VSFTPD either). Yes, the domain will have to be the same to avoid any cert errors.

Answer 2

x.509 Certificates are issued on a domain name basis, so whatever service is listening on that specific domain name and wants to use SSL/TSL encryption should use the x.509 certificate issued for that domain.

I would say it is beyond good practice, not doing so would be bad practice. Though you might want to consider spreading your services on seperate sub domains (like ftp.domain.example, imap.domain.examle) and subsequently use different certificates for each of them.

Some administrators like to keep things simple and thus use a wildcard certificate for all these sub domains, from a cryptographic point of view I would recommend against it, a breach on one of the services using that wildcard certificate (if able to get the private key) will render all other services vulnerable too.

Answer 3

The problem of this approach is that:

1)FTPd and HTTPdhas to run on same domain (Which means same IP address, if you are not using port redirection at firewall level). Or you can specify alternate name for ssl cert, like ftp.domain.com , domain.com www.domain.com etc .

2)FTPd / HTTPd can decrypt each others data. so, if attacker would compromise FTPd, it would compromise HTTPd trafic security and vice versa.