1

One of the customers does not have FQDN, only virtual ip, and two servers. Primary and Secondary. Do we need to generate and install two seperate TLS certificate for both the servers. Or can we assign a FQDN and use one single wildcard certificate in redundancy setup ?

1

The two server may:

  • Have the same certificate
  • Have different certificates covering the same domain(s)
  • Have different certificates covering different domains, even with wildcard (but at least covering the domain you want for redundancy).

Valid examples:

For example.com:

  • Server1 certificate covers example.com
  • Server2 certificate covers www.example.com,example.com

For example.com:

  • Server1 certificate covers example.com
  • Server2 certificate covers *.example.com,example.com

For www.example.com:

  • Server1 certificate covers www.example.com
  • Server2 certificate covers www.example.com,example.com

For www.example.com:

  • Server1 certificate covers www.example.com,example.com
  • Server2 certificate covers *.example.com,example.com

Invalid example:

For example.com:

  • Server1 certificate covers example.com
  • Server2 certificate covers *.example.com Because *.example.com is NOT valid for example.com

Security notes: Be careful, if the certificate of a server covers MORE domains than the server is supposed to answer, it may be vulnerable to virtual host confusion attacks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.