I have a mail server and a postfixadmin application sharing the same certificate for https and postfix TLS encryption.
Is it a good practice?
Thanks in advance for your Help.
-
1imgur.com/a/NGKuHrn those are all the same certificate. Doesn't mean it's a good practice. Could be more convenient and less messy than managing different certificates for each.– Greg AskewCommented Aug 2 at 7:56
Add a comment
|
2 Answers
A certificate is used to identity a system or service. If it is the same system or service or if the certificate covers multiple systems or services then the same certificate can be used.
But, this reuse over multiple services or systems might involve copying the private key to more places or maybe more systems. Any additional instance of the same private key increases the risks of having the private key compromised. And any additional services which uses the same private key is also a service which is affected once the key is compromised.
Therefore it is necessary to find the right balance between increasing the risk of key compromise and administrative burden of maintaining multiple keys and certificates.
Apart from that it is a common problem to forget where the certificate/key was used and replace only some but not all instances when renewing the certificate.
-
I use inotify to copy the key when it is renewed automatically by Traefik. So less risk. Commented Aug 5 at 17:27
As common practice there is no serious challenge to use the same certificate for more than one application (especially if they are on the same host). Just put certificate, key and CA chain in one place and point apps to this place. At the end you have in certificate the host name and not the port(s) involved.
Also think about wildcard certificates where the same certificate is used in hosts in entire domain. Yes, this increase maintenance and security complexity, but you can find the right balance between price, maintenance and security.
