Certificate per box or per vip?

[kelvin-yeo]

Hi pros,

Just a short one on certificate.

If my CSS(1 SSL module) is serving 3 different SSL VIPs, do i need to install 3 pairs of keys/cert, or only required 1 pair of key/cert per CSS?

eg,

content https1

vip address 192.168.99.90

application ssl

add service x

protocol tcp

port 443

active

content https2

vip address 192.168.99.91

application ssl

add service x

protocol tcp

port 443

active

content https3

vip address 192.168.99.92

application ssl

add service x

protocol tcp

port 443

active

So does the above all points to 1 same 'ssl_front' ?

service ssl_front

keepalive type none

slot 2

add ssl-proxy-list ssl-list1

type ssl-accel

active

Rdgs,

confused

[kelvin-yeo]

Hi,

i did a research in this forum. understand that certificate relates to the domain.

if 3 above contents serve below urls respectively,

www.auto.com.my - 192.168.99.90

backoffice.auto.com.my - 192.168.99.91

tr.auto.com.my - 192.168.99.92

then i believe i need to only subscribe 1 verisign certificate using 'auto.com.my' and then point these services to same "ssl_front". please correct me if im wrong anywhere...

cheers

[Gilles Dufour · Accepted solution]

browsers verify that the name of the server matches the name of the certificate.

So, you'll need 3 certificates or 1 wildcard certificate.

This is a certificate with a name like *.auto.com.my.

So, see what is cheaper for you.

Gilles.