Our setup is like this.

SOAP services are exposed and clients send requests to SOAP endpoints. Each node provides the SOAP services. There can be one or more (maximum 6) nodes as a cluster. Multiple clients can contact the system. A load balancer that sits at the front of the nodes balances the traffic by distributing to any of the nodes.

Apache with tomcat is used to deploy the system on a SUSE Linux server.

The case now is migration to 2048 bit RSA key SSL certificates. During the migration, few of the clients may still be using 1024 bit length certificates and few of them may be using 2048 bit lenght ( All the clients may not update to 2048 bit at the same time). So during this transition period, it may be needed to support both 1024 and 2048 bit RSA key SSL certificates.

Is this possible to support multiple SSL certificates in Apache? How can this be done? Which certificate shall be selected when multiple certificates are present?

I have verified few questions with similar scenarios but the clients in our system are not only web browsers but can also be any standalone applications which send requests to the SOAP endpoints.

migrated from security.stackexchange.com Jul 27 '15 at 21:09

This question came from our site for information security professionals.

  • Are you talking about client certificates? – StackzOfZtuff Jul 27 '15 at 19:41
  • @StackzOfZtuff Clients can use different certificates (either 1024 or 2048 bit certificates). But the apache on our server should be able to accept requests from all the clients. Can we configure multiple certificates in Apache server so that the requests from different clients which different requests can be served? – Nerdyme Jul 28 '15 at 4:55
  • So these are certificates that the clients use to identify themselves, right? – StackzOfZtuff Jul 28 '15 at 4:56
  • @StackzOfZtuff yes..Right – Nerdyme Jul 28 '15 at 6:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.