Timeline for Should one use separate SSL certificates for front-end and back-end?
Current License: CC BY-SA 3.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 24, 2017 at 9:18 | vote | accept | NG. | ||
| Nov 22, 2017 at 15:50 | answer | added | Viktova | timeline score: 0 | |
| Nov 22, 2017 at 14:45 | comment | added | Steffen Ullrich | It might make more sense if you move your back-end behind the the same server which cares about the front-end, i.e. don't access it directly but access is done through a reverse proxy. This simplifies securing everything and this way you also only need a single certificate for both since there is only a single customer facing system. | |
| Nov 22, 2017 at 14:38 | comment | added | NG. | It indeed was a mixed content warning. My back-end is a Node.js Express REST API which handles logins and all other data requests. My front-end is just a html/javascript (Vue.js) website hosted on Apache, on the same server. So apache serves the website to the client, who runs it and makes calls to the Node.js API. | |
| Nov 22, 2017 at 14:34 | history | edited | NG. | CC BY-SA 3.0 |
fixed a typo
|
| Nov 22, 2017 at 14:34 | comment | added | Steffen Ullrich | "Today I set up SSL for the front-end and got an error that a request to the back end was not over SSL and thus blocked." - I'm not sure but this sounds like a mixed content error from the browser. Do you include your "back-end" directly into the pages generated by your front-end? The usual way is to have the back-end server behind the front-end (i.e. reverse proxy) in which case the certificate visible by the client is the one from the front-end. | |
| Nov 22, 2017 at 14:09 | history | asked | NG. | CC BY-SA 3.0 |