We have different Web Sites on different IIS Servers belonging to the same Domain as site1.example.com, site2.example.com, site3.example.com. However, we have no idea about how to use the same certificate on different IIS Servers and Web Sites. So, which steps should we apply in order to use the certificate of example.com on different IIS Servers for these Web Sites? Could you please clarify us regarding to this issue?
You may issue different x509 certificates for every host or site. Or, if using one certificate, subject alternative names and wildcard host names are commonly supported.
There are a great many tutorials on TLS and x509 certificates. Here is one introduces the topic: How to Use X.509 Certificates and SSL For Secure Communications
There are three steps involved here:
- Actually purchasing the certificate
- Installing the certificate on one server
- Exporting the public/private keys of the certificate for installation on additional servers
Actually purchasing the certificate
In order to secure multiple subdomains of the same domain, you have two options.
- UCC (Unified Communications Certificate) certificate: UCC certificates can be used to secure multiple subdomains, but you must know which subdomains you want to secure when you purchase the certificate. When you generate the CSR (Certificate Signing Request), you will be required to enter the various subdomains as SANs (Subject Alternative Names).
- Wildcard certificate: Can be cheaper or more expensive than UCC depending on how many subdomains you need to secure. You might have no choice as well if you don't yet know all the subdomains you need to secure.
Installing the certificate on one server + Exporting the public/private keys of the certificate for installation on additional servers
This is largely platform dependent if you need the actual steps, so if you do, let me know your OS and IIS version and I'll edit my answer.
Use the same process to import the certificate PFX into the local machine Personal/My store using the Certificates MMC on the other IIS servers, then use IIS Manager to select the certificate.
If you do not already have the certificate PFX, export it from one of the existing IIS servers that may have the certificate.
If the certificate private key is marked as "not exportable", you may use JailBreak to export the certificate.
You can use a wildcard certificate (*.example.com) and import it on a server. The same can be said for a certificate with different subject alternate names. For simplicity, a pfx-type of certificate is the easiest. You can import this certificate on all servers and use it.