Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am working on IIS 7.0 on Windows Server 2008 Enterprise x64. I want to know if I apply for a certifcate from Verisign, is the certificate bind to domain name or bind to computer? Any comments to my 2 concerns below?

More details,

  1. if the certificate is bound to computer other than domain name, then if the computer has some physical H/W issues, how could I transfer the certificate to another computer?

  2. if I have a server farm of two computers, which two physical machines map to the same DNS domain name to load balance by DNS round robin name resolution. If certificate binds to machine other than domain name, how could I install the certificate on two computers to serve https from two computers?

thanks in advance, George

share|improve this question

1 Answer 1

up vote 1 down vote accepted

A standard SSL certificate is not bound to an IP or name, instead the machine your using it on needs to have access to the certificates private key.

You can export this certificate and use it on another machine quite easily, most commonly as a pfx file, which will include the certificate and its private key (password protected). You can also use it on multiple machines at the same time, for example in your web farm situation.

A certificate is used to verify a particular domain name. In the case where you are using the certificate on a website, you can move this website to another machine, with a different IP address, and machine name, and take the certificate with you, so long as your sites URL doesn't change.

If you were using your certificate to secure something like and RDP connection then it's a little more complicated as that is tied more closely to the actual machines name.

share|improve this answer
    
I can even use the certificate on a machine different domain name? Does it work or have any meaningful benefits? –  George2 Dec 14 '09 at 16:53
1  
I think you are mixing up the machine name and your websites URL here. The certificate itself is only used to verify a single domain (putting aside SAN certs here) so, your certificate will be for say 'domain.com'. You can move domian.com to be hosted on another server and take the certificate with you. You can't however decide to change your websites URL to waffle.com and use the same certificate –  Sam Dec 14 '09 at 16:56
    
Thanks, question answered! –  George2 Dec 14 '09 at 17:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.