We use an SMA for a mail relay environment at a customer.
End users are accessing the HTTPS production interface for the SPAM quarantaine. Our operation team use the HTTPS management interface for daily operation. They are using the old web interface and using the ip address of the mngt interface, eg. https://10.a.b.c/.
We have installed one certificate on the box. The CN in this certificate matches with the hostname used by end-users, they see a valid certificate when accessing the spam quarantaine.
Our operation team sees the same certificate when they access the box and that certificate looks invalid, because they are using an ip address. Also the hostname associated with that interface doesn't match the CN of the certificate, thus switching to using the hostname doesn't solve that warning.
We are thinking about switching to the new web interface. To do that we must starting using hostnames on the management interface and using a valid certificate. However I can't see how to use different certificates for the production interface and another one for the management interface.
Questions:
- Can we use different certificates for the different interfaces/ports?
- How do we configure that?
The only thing I can think of is specifying all possible hostnames in the SAN field of the certificate, but that exposes information of our environment (just a tiny bit) to the end-users of our customer.
Henk
