Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Example:

Wildcard SSL certificate for *.example.com installed on two different boxes.

hostEU.example.com  A  60.70.80.90
hostUS.example.com  A  200.210.220.240

I assume this is a perfectly valid scenario, where the actual hostnames do not reside on the same IP (or even the same box for that sake).

Is my assumption correct?

share|improve this question

2 Answers 2

up vote 6 down vote accepted

Yes, there is not technical limitation for this; except if your CA prohibits this use explicitly.

The most frequently limitation given by a CA is on the "physical servers", but may be someone limits even on IP basis.

As an example, Geotrust Wildcard Ssl says:

If you need to span the wildcard certificate across multiple physical servers, you may purchase additional licenses.

share|improve this answer
3  
Can you give a real-world example of a CA effectively prohibiting the use of a wildcard cert on multiple IP addresses? –  womble Nov 3 '09 at 17:58
2  
I don't think I have seen anything mentioning multiple IP addresses, but I have seen several examples where installing the cert on multiple 'servers' violates the TOS. I wasn't checking the wildcard TOS specifically. See the Geotrust QuickSSL cert for an example of that is tied to one 'server'. –  Zoredache Nov 3 '09 at 18:13
2  
Pfft, tell them to go stuff their ToS up their collective fundaments. Ridiculous and inappropriate restrictions ftl. –  womble Nov 3 '09 at 18:46
1  
@womble, I don't think anyone disagrees. In many ways the whole SSL Certificate system is a scam. (blogs.techrepublic.com.com/security/?p=2550) –  Zoredache Nov 3 '09 at 18:54
1  
Even if prohibited by the CA, can they actually find out? And if so, what can they do, revoke it? –  mr-euro Nov 3 '09 at 18:59

I know a lot of CAs do limit you to set number of "physical" server. Certainly my experience of Comodo is such.

But can the ToS being avoiding when you deploy on a cluster of "virtual" machines?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.