Assume I've generated a server key for use by Apache for SSL. The server will be handling several different domains that use SSL via unique IPs (no SNI).
I want to generate a CSR for each domain from the same key, get it signed, and then configure each domain to present the appropriate certificate.
Is there any reason I should generate a server key for each domain instead of doing this, if all domains will be hosted on the same server?
I can see two primary reasons why you might not want to re-use the same key:
Compromise resilience: If the private key gets leaked, and if you've re-used it for multiple domains, then multiple domains will be affected. If you use separate private keys and store each on a separate server, then compromise of one doesn't affect the others. If you're planning to host all the domains on a single server, this probably doesn't matter -- but using separate keys may preserve your flexibility to change the hosting details.
Future-proofing: Suppose one day in the future the owner of one of the domains says "I'd like to start hosting the domain myself; can you please give me the cert and private key for that domain?" If you've reused the same private key for multiple domains, you cannot oblige them.
Or similarly, maybe one day one of these domains will become highly popular, and you'll want to buy multiple servers to host it and start load-balancing across them. If you've re-used the same private key, then all of those servers need to receive the common private key, and if any of the servers is compromised, all the domains are hosed. On the other hand, if you use separate private keys, then you can give each of those new servers a copy of just the private key for the one domain that became very popular.
These considerations may or may not matter in your particular situation. You can decide for yourself the convenience benefits of having a single private key, vs. the flexibility for the future of having multipel private keys.
