topic How many CSS SSL certificates needed? in Application Networking

How many CSS SSL certificates needed?

eleibowitz — Mon, 28 Nov 2005 16:17:21 GMT

From reading the CSS SSL Configuration Guide, it seems that one certificate is needed for each virtual SSL server (or VIP), regardless of how many servers are being load-balanced behind that VIP, but that is not made very clear. Also, it appears that a separate certificate is required for each virtual SSL server. Can someone please confirm or correct this for me? Thank You.

Re: How many CSS SSL certificates needed?

Gilles Dufour — Mon, 28 Nov 2005 19:30:26 GMT

a certificate is usually linked to a domain name.

So, it does not matter how many vip or servers you have.

The most important is the domain.

There is also wild card certificates that can regroup multiple domain name.

I would suggest you to ask your certificate provider what is required in your case.

If he questions your equipment just say you have 1 apache server.

Regards,

Gilles.

Re: How many CSS SSL certificates needed?

eleibowitz — Mon, 28 Nov 2005 21:27:03 GMT

Gilles,

Thanks for the quick response. Your response prompted me to check Verisign's SSL Certificate FAQs, restated and elaborated on your answer.

Re: How many CSS SSL certificates needed?

eleibowitz — Thu, 01 Dec 2005 20:25:37 GMT

A quick (I hope) follow-up question on this...

Given multiple domain names being load-balanced by a CSS with a single SSL module, would I need different key and cert associations? I am thinking of something like this:

ssl associate rsakey prodkey prodkey.pem

ssl associate cert prodcert prodcert.pem

ssl associate dhparam proddh proddh.pem

ssl associate rsakey intkey intkey.pem

ssl associate cert intcert intcert.pem

ssl associate dhparam intdh intdh.pem

Re: How many CSS SSL certificates needed?

Gilles Dufour — Fri, 02 Dec 2005 07:56:39 GMT

you are correct.

If you have multiple domain and each one has its own key/cert, you will need to import all the files and associate them.

FYI, I never saw any site where DH was being used.

So you most probably do not need it.

Gilles.