Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Or ssl web site is accessed in 2 ways: 1) using web-browsers 2) using our client application

We want to bundle the client app with our own CA certificate (not trusted by browsers), in order to be 100% sure, that no one can access the encrypted data. (Even ones who operate trusted Intermediate CA). We want our app to trust only certificates signed by our CA.

And, of course, we want this site to open in browsers without warnings.

So, is there any way to put 2 certificates on single host, port and domain, one that is trusted by our app, and another trusted by the browsers?


We can use a different host for app access, but out management do not want to take a risk of bad PR attacks against us targeted to semi-educated IT community (Imagine a publication, when someone points to our server and says "Ha-ha, they use a free self-signed certificate, they are so unsecure.")

share|improve this question
Have you tried just concatenating the two certificates? When an intermediate certificate has to be presented in addition to a third-party signed cert, common practice is simply to cat the two certs into a single file, and have that presented to browsers. If browsers are happy with that, it may well be that they're also happy with two separate 3rd-party signed certs (one commercial, one from your CA) being presented. – MadHatter Jan 16 '14 at 13:02

You can't put 2 certificate for a single host. But you could easily have two vhost poiting to the same web application.

  • for browser
  • for the application

Each of them having their own certificate.

The main problem with that is that nothing prevent a browser user to use and vice versa.

Another less elegant option would be a different port but the same domain.

  • for browser
  • for the application

You can only have one certificate by domain:port pair.

share|improve this answer
Seconded, and I'd recommend going with separate vhosts. It will also make it a lot easier if you ever need to run them on separate servers or split them up in some other way. – Jenny D Jan 16 '14 at 14:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.