I want to offer our online services over HTTPS and am having a couple of problems understanding how to accomplish this. To access our services you must pass through our ISA firewall to a Win2000 server running IIS6. About half of our services are located here, and the other half take you to a Win2003 server also running IIS6. So, in order to achieve this must each server have the proper certificate installed? ISA, IIS6_1 and IIS6_2? Is there a separate configuration that must be made to our ISA firewall?
The other problem is with the CA and knowing how many certificates I need. It's important to note that the domain name for our services on IIS6_1 is www.example.com
, but the domain name on IIS6_2 is services.example.com
. I believe that this will require me to purchase more than one certificate. It looks as though we will be going with Thawte's SSL123 as it's a good name and it's fast to get. Will I need to purchase two certificates (one for www.example.com
which will be installed on our ISA firewall as well as IIS6_1, and one for services.example.com
on IIS6_2)? Or will I need to purchase three, the extra one being used on our firewall server?
Another side question is about SANs (subject alternative names). Is this basically adding sub-domains to your cert? So I could purchase one cert with one SAN for www.
and services.
?