topic Re: CSS 15000 multiple certification assignment in Application Networking

CSS 11501S multiple certification assignment

patcocoon — Sun, 22 Nov 2009 13:41:39 GMT

Hello,

Is there a way to assign a key pair to two different virtual SSL servers, they differentiate only at the port.

Example

Virtual SSL Server1, Certification1 = 10.0.0.1:443 www.domain1.com

Virtual SSL Server2, Certification1 = 10.0.0.1:4443 www.domain1.com

(Cisco CSS 11501S-C Load Balancer)

Best regards,

Pat

Re: CSS 15000 multiple certification assignment

Gilles Dufour — Mon, 23 Nov 2009 08:36:06 GMT

yes, you can create multiple ssl-server on the CSS and select the one you would like to use based on the destination port.

Create the ssl-server inside the ssl-proxy list. One listening on port 443 and the other listening on port 4443

Just be aware that a certificate contains the domain name, and that client browsers complain when the ip address does not match domain name.

CSS11503-2(config-ssl-proxy-list[gdufour])# ssl-server 1 por?
port Specify the ssl-server's Virtual Port

Gilles.

Re: CSS 15000 multiple certification assignment

patcocoon — Mon, 23 Nov 2009 09:06:17 GMT

In our case the domain name will matches the IP address of the both virtual servers so there should not be a problem for the browser. Because both servers will have the same IP, they will represent the same domain name and therefore they must use the same certificate / key pair.

Will be there any problem assigning the same certificate / key pair to different virtual SSL servers?

Pat

Re: CSS 15000 multiple certification assignment

Gilles Dufour — Mon, 23 Nov 2009 13:23:06 GMT

You can reuse the same key/cert. No problem there.

Gilles.