0

I have a website hosted by Apache on a Linux server. I also have a Node.js back-end/API that is hosted on the same server, which serves all the front-end's requests. Today I set up SSL for the front-end and got an error that a request to the back end was not over SSL and thus blocked.

Now I'm in the process of setting up SSL for my back-end, but I'm wondering something: Do I need a separate certificate for my back-end or is it okay to share it between the two applications?

Thinking about this raised another question: An SSL certificate is issued for a domain name. My back-end is not hosted on any domain, just on my server. Do I need to register it to a sub domain to be able to implement SSL for it?

Improve this question
3
  • 1
    "Today I set up SSL for the front-end and got an error that a request to the back end was not over SSL and thus blocked." - I'm not sure but this sounds like a mixed content error from the browser. Do you include your "back-end" directly into the pages generated by your front-end? The usual way is to have the back-end server behind the front-end (i.e. reverse proxy) in which case the certificate visible by the client is the one from the front-end.
    – Steffen Ullrich
    Commented Nov 22, 2017 at 14:34
  • It indeed was a mixed content warning. My back-end is a Node.js Express REST API which handles logins and all other data requests. My front-end is just a html/javascript (Vue.js) website hosted on Apache, on the same server. So apache serves the website to the client, who runs it and makes calls to the Node.js API.
    – NG.
    Commented Nov 22, 2017 at 14:38
  • 1
    It might make more sense if you move your back-end behind the the same server which cares about the front-end, i.e. don't access it directly but access is done through a reverse proxy. This simplifies securing everything and this way you also only need a single certificate for both since there is only a single customer facing system.
    – Steffen Ullrich
    Commented Nov 22, 2017 at 14:45

1 Answer 1

Reset to default
0

As for the question "Should one use separate SSL certificates for front-end and back-end?", the answer is NO

Secure Sockets Layer (SSL) certificates, sometimes called digital certificates, are used to establish an encrypted connection between a browser or user's computer and a server or website. The SSL connection protects sensitive data, such as credit card information, exchanged during each visit, which is called a session, from being intercepted from non-authorized parties.

Why? Because as you said, both are running on the same server. Although You can use multiple SSL certs on different sub-domains but its usually the BEST to stick to one SSL Certificate per domain.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .