1

Or ssl web site is accessed in 2 ways: 1) using web-browsers 2) using our client application

We want to bundle the client app with our own CA certificate (not trusted by browsers), in order to be 100% sure, that no one can access the encrypted data. (Even ones who operate trusted Intermediate CA). We want our app to trust only certificates signed by our CA.

And, of course, we want this site to open in browsers without warnings.

So, is there any way to put 2 certificates on single host, port and domain, one that is trusted by our app, and another trusted by the browsers?

UPD:

We can use a different host for app access, but out management do not want to take a risk of bad PR attacks against us targeted to semi-educated IT community (Imagine a publication, when someone points to our server and says "Ha-ha, they use a free self-signed certificate, they are so unsecure.")

1
  • Have you tried just concatenating the two certificates? When an intermediate certificate has to be presented in addition to a third-party signed cert, common practice is simply to cat the two certs into a single file, and have that presented to browsers. If browsers are happy with that, it may well be that they're also happy with two separate 3rd-party signed certs (one commercial, one from your CA) being presented.
    – MadHatter
    Jan 16, 2014 at 13:02

1 Answer 1

1

You can't put 2 certificate for a single host. But you could easily have two vhost poiting to the same web application.

  • www.example.com for browser
  • app.example.com for the application

Each of them having their own certificate.

The main problem with that is that nothing prevent a browser user to use app.example.com and vice versa.

Another less elegant option would be a different port but the same domain.

  • www.example.com(:80) for browser
  • www.example.com:8080 for the application

You can only have one certificate by domain:port pair.

1
  • Seconded, and I'd recommend going with separate vhosts. It will also make it a lot easier if you ever need to run them on separate servers or split them up in some other way.
    – Jenny D
    Jan 16, 2014 at 14:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .