2

Currently I'm able to get a single Let's Encrypt SSL certificate working on one server with multiple subdomains.

eg. m.example.com, www.example.com, example.com on Server A

However, in order to use eg. cdn.example.com on Server B, how can I make the implementation?

My ideas are:

(1) single certificate on Server A, containing all subdomains: cdn.example.com, m.example.com, www.example.com, example.com, then rsync it to Server B

(2) one certificate on Server A, containing: m.example.com, www.example.com, example.com

second certificate on Server B, containing only: cdn.example.com

What's the correct way or best approach to make the implementation?

I'm not sure if I'm allow to generate multiple certificates regarding to one the root domain example.com

I find that (1) is easier when it comes to renewal in case I scale to multiple servers.

Can it be done this way? Or it's redundant?

UPDATE:

same SSL certificate in two servers does not fully address my question. The accepted solution partially answer that SSL cert is FQDN specific, and not machine specific.

If that's the case, isn't my proposed (1) a simplified solution?

My question is that:

Can I have a partial SSL cert containing only subdomain cdn.example.com but leave out the others on Server B then having another SSL cert issued for Server A with the root domain example.com, www.example.com, and m.example.com?

  • 1
    you can use the same certificate and key in multiple servers, not sure it`s the best practice though, as per documentation you can issue the "same" ( a new one with all the same sub-domains ) certificate 5 times a week see the limit's in letsencrypt.org/docs/rate-limits – Rafael Rotelok Feb 7 '17 at 0:33
  • 2
    Possible duplicate of same SSL certificate in two servers – Tim Feb 7 '17 at 0:38
  • "Can I have a partial SSL cert containing only subdomain cdn.example.com but leave out the others on Server B then having another SSL cert issued for Server A with the root domain" How did this work out for you? – PJ Brunet Mar 10 '18 at 10:36
  • @PJBrunet It does work. Using (2) mentioned above, I have multiple micro VPS instances sharing the same SSL cert for cdn.example.com to distribute the workload. – KDX Mar 10 '18 at 14:53
  • @KDX OK, I was hoping to use different certificates for each subdomain/server. – PJ Brunet Mar 11 '18 at 8:49
3

IMHO, Each server should have it's own private key, you can issue as many certs as you like with LE, the only reason I can think of to use multiple SANs per IP is if your clients cannot do SNI (example: old java clients if you're using webhooks/api's or other endpoints).

TLDR; option 2, just don't forget to set your auto-renewal cronjobs and enter a valid email in-case something went wrong.

Another reason I would use separate keys for your app/assets is different levels of trust. I assume your images don't matter as much as your code/content and you will not be submitting forms to your users via the CDN, Server A may be onsite and Server B in public cloud on SSD.

  • Do you have any references or further information to back up your opinion? You can use the same private key and certificate on multiple servers easily. I agree though, option two would probably be slightly better, though either should work and option two reduces risk of revealing the private key. – Tim Feb 7 '17 at 0:39
  • absolutely either does work, if he's splitting the dependencies of his assets and apps, why wouldn't he split his ssl? :) and @Tim experience/opinion answer. – Jacob Evans Feb 7 '17 at 0:41
  • I agree that from security point of view, separate keys might be a better approach. Can I only generate a Let's Encrypt SSL certificate containing only subdomain cdn.exmaple.com? Or it must contains the root domain example.com as well? – KDX Feb 7 '17 at 2:06
  • I have separate certs for main and subdomains, so no problem not to have main. – Lenne Feb 10 '17 at 12:21
0

Let's Encrypt now has wildcard certificate support, which I think would fit your use case the best.

The following Let's Encrypt blog post describes how to generate the wildcard certificate with Let's Encrypt DNS-01 challenge.

https://community.letsencrypt.org/t/acme-v2-production-environment-wildcards/55578

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.