I work for a consultancy that develops internal and intranet web applications. We do not own or manage any infrastructure but do install and support the applications. We've had a request asking us to take over configuration and management of HTTPS/SSL on a web server. Is there any reason why this would sit with the application developer as opposed to the IT Infrastructure team who would manage and administer the server?
As I understand it, the certificate would belong to the server and should ideally by managed by those who own the server, I'm not aware of any reason that the application would need to be aware of the certificate that would require the developers to own the configuration of the web server.
What is best practice for this? especially when developers are a 3rd party working on behalf of a client.
Edit: in this instance we are dealing with straightforward LOB CRUD applications, so I can't think of any special cases that would require the app itself to do anything unusual. Not that I want to discourage answers that may apply to others who may be in that situation!