Hopefully a very simple question, if I wanted several servers providing the same service to hold a certificate (e.g interface.internal.org) would the procedure be;

  • Generate Public/Private Pair on one web server
  • Generate CSR and receive Certificate
  • Copy Private/Public Key Pair and Certificate to each server

Although there is the potential to place certificates at the load balancing layer, I wanted to investigate other ways - plus the servers have SSL accelerators so performance isn't really a factor.



  • Cheers for the sanity check people, I thought it was possible! – Tom Werner Feb 22 '10 at 21:50

Your procedure as indicated above should work

| improve this answer | |

Yes your procedure will work. If you are using a commercial SSL cert provider, check if you need to pay for additional licences for each extra cluster node. This is the case with Thawte, for example. If using internally generated certsthen this won't be an issue.

| improve this answer | |
  • The certificate licensing is a worthy note, thankfully my chosen supplier allows deployment throughout a network. – Tom Werner Feb 22 '10 at 21:52

That will work with apache, but IIS generates its own CSR for each server. Just watch out for that.

| improve this answer | |
  • Cheers, thanks for the heads up, thankfully I am using OAS (Apache based I believe) – Tom Werner Feb 22 '10 at 21:44
  • You can generate a single request, get the cert and install it, then export the key\cert pair and put it on the other servers. Provided you haven't flagged it as non exportable in the first place (or don't want to resort to hacking) – Helvick Feb 22 '10 at 22:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.