10
votes

Example:

Wildcard SSL certificate for *.example.com installed on two different boxes.

hostEU.example.com  A  60.70.80.90
hostUS.example.com  A  200.210.220.240

I assume this is a perfectly valid scenario, where the actual hostnames do not reside on the same IP (or even the same box for that sake).

Is my assumption correct?

2 Answers 2

9
votes

Yes, there is not technical limitation for this; except if your CA prohibits this use explicitly.

The most frequently limitation given by a CA is on the "physical servers", but may be someone limits even on IP basis.

As an example, Geotrust Wildcard Ssl says:

If you need to span the wildcard certificate across multiple physical servers, you may purchase additional licenses.

11
  • 5
    Can you give a real-world example of a CA effectively prohibiting the use of a wildcard cert on multiple IP addresses?
    – womble
    Nov 3, 2009 at 17:58
  • 2
    I don't think I have seen anything mentioning multiple IP addresses, but I have seen several examples where installing the cert on multiple 'servers' violates the TOS. I wasn't checking the wildcard TOS specifically. See the Geotrust QuickSSL cert for an example of that is tied to one 'server'.
    – Zoredache
    Nov 3, 2009 at 18:13
  • 5
    Pfft, tell them to go stuff their ToS up their collective fundaments. Ridiculous and inappropriate restrictions ftl.
    – womble
    Nov 3, 2009 at 18:46
  • 3
    @womble, I don't think anyone disagrees. In many ways the whole SSL Certificate system is a scam. (blogs.techrepublic.com/security/?p=2550)
    – Zoredache
    Nov 3, 2009 at 18:54
  • 2
    Even if prohibited by the CA, can they actually find out? And if so, what can they do, revoke it?
    – mr-euro
    Nov 3, 2009 at 18:59
0
votes

I know a lot of CAs do limit you to set number of "physical" server. Certainly my experience of Comodo is such.

But can the ToS being avoiding when you deploy on a cluster of "virtual" machines?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .