Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sorry if this is a real newb question, but is it possible/good practice to use the same SSL certificate for two different daemons? I have VSFTPD running which I want to setup to run with FTPS. I already have an SSL cert which I'm using to protect phpmyadmin over Apache and wondered if I could just use the same certificate (I assume the domain would have to be the same).

Any thoughts on this are appreciated.

Thanks very much,

James.

share|improve this question

3 Answers 3

Yes, it can be done as the two services are listening on different ports.

I'm not familiar with the specifics of doing so with either VSFTPD or Apache though sorry.

You just have to ensure both VSFTPD and Apache are using the same private key as well as the cert itself (and potentially any intermediate root certs that come in to play with your SSL certificate - if you didn't need to install one for apache, you shouldn't need to for VSFTPD either). Yes, the domain will have to be the same to avoid any cert errors.

share|improve this answer

x.509 Certificates are issued on a domain name basis, so whatever service is listening on that specific domain name and wants to use SSL/TSL encryption should use the x.509 certificate issued for that domain.

I would say it is beyond good practice, not doing so would be bad practice. Though you might want to consider spreading your services on seperate sub domains (like ftp.domain.example, imap.domain.examle) and subsequently use different certificates for each of them.

Some administrators like to keep things simple and thus use a wildcard certificate for all these sub domains, from a cryptographic point of view I would recommend against it, a breach on one of the services using that wildcard certificate (if able to get the private key) will render all other services vulnerable too.

share|improve this answer

The problem of this approach is that:

1)FTPd and HTTPdhas to run on same domain (Which means same IP address, if you are not using port redirection at firewall level). Or you can specify alternate name for ssl cert, like ftp.domain.com , domain.com www.domain.com etc .

2)FTPd / HTTPd can decrypt each others data. so, if attacker would compromise FTPd, it would compromise HTTPd trafic security and vice versa.

share|improve this answer
    
If you specify a different domain you'll need a *.domain.tld cert which is really expensive. Otherwise you'll need domain.tld and domain.tld to be the same and resolve to the same IP to avoid cert errors –  David Rickman Aug 13 '09 at 10:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.