unique certificates and TLS protocol

Question

I know we can use TLS protocol to create a secure connection between a server and a client. My question is : Certificates ,which use in TLS, are unique for each connection (pair)?. e.g. in a data-center with thousands of switches and hosts, Secure connections between a main controller and devices (like SDN controller and southbound devices) will happen with thousands of certificates? or using a certificate (or a pair? "i don't know") in whole of network or a part of it?

Answer 1

A certificate serves to identify a connection endpoint, like a device or user. Any of the client computers can verify a server's certificate was signed by the company's root certificate, which can assure them that they're connecting to a genuine trustworthy endpoint. So each server needs only one certificate.

Similarly, the (optional) client certificate is issued to a machine or user. The server can validate that the client is who he says he is; plus, the server can read a value from the Distinguished Name field on the certificate to ascertain the client's identity.

So when using certificates for authentication, you don't need to establish one pair of certs between each communicating pair of endpoints. You just need one cert for each server and (optionally) one for each client.

Answer 2

Apart from what Steffen already answered, especially

So when using certificates for authentication, you don't need to establish one pair of certs between each communicating pair of endpoints. You just need one cert for each server and (optionally) one for each client.

and

So each server needs only one certificate.

there is another part of your question I'd like to address:

You are asking if there are thousands of TLS-secured connections within data centers and if they all use unique certificates. The answer is generally "yes" for general purpose data centers where everyone might be co-hosted and the network within the data center is not considered secure.

Yet, in data centers that are exclusive for one company that has to deal with a lot of requests, there are usually so called https reverse proxies which dedicated job it is to decrypt the https connection from the internet, use it without encryption within the (secure) network in the data center and later wrap the answer back up in TLS.

This is done mainly for performance and debugging reasons, a single certificate with a single host name can thus seamlessly be used by a cluster of machines, making it more resilient to problems, faster and more reliable as well as easier to modify.

Please note that while this is not fully how TLS was meant to be used, it doesn't actually interfere with the properties a TLS certificated does guarantee: it's still the same entity and only that entity (the big company) that can peek into your traffic.