Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've recently purchased an SSL certificate, and it says that it's limited to three servers. Surely if I have the key and certificate on multiple servers (more than 3), the SSL will still be valid? Can someone clarify why/how vendors can limit this? An example of one is 123-reg's 123-SSL (which is a resell of AlphaSSL).

share|improve this question
up vote 15 down vote accepted

There are no technical reasons for such a limit, it's purely licensing (i.e. revenue, and maintaining market segmentation). There are some considerations relating to the secure transfer of the key between systems when you do this, but this is easily addressed.

If you violate the license or terms of an agreement you risk (at least) getting your certificate revoked.

They (the CA/reseller) might be able to tell how many servers you have by:

  • inspecting your site for signs of load-balancing (e.g. different server signatures or E-Tag headers), or even just multiple DNS A records
  • monitoring OCSP stapling requests and recording the source IPs and frequency of requests, in the unlikely event you have this configured

Neither method is reliable and conclusive however.

It is possible to put public IP addresses in certificates, though some CAs do not support this (e.g. GoDaddy). This is not commonly used in for standard "web" certificates. Such a "name" is only checked by browsers if the URL contains an IP address in the host part (i.e. the browser doesn't check both IP and DNS for URLs containing DNS names). Web servers don't tend to check the certificates they are presenting as thoroughly as a browser, and assume the administrator knows what they are doing. Even if this worked as a method of limiting concurrent use by causing (user-visible) browser errors, it would only be effective if all servers had public IP addresses (no NAT or front-end proxy/load-balancer).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.