0

In here it said some CA's wouldn't permit using the same SSL certificate on multiple servers: Can I use a single SSL cert on two different servers?.

But what about two instances from the same server. So on the same machine the site is hosted at port 443 and port 5000 for example(https://sitex.com and https://sitex.com:5000), would this be a legal problem? My certificate is from GoDaddy, but I am unsure which certificate type it is; I am not the one who bought it.

closed as off-topic by Steffen Ullrich, WhiteWinterWolf, TheJulyPlot, Bacon Brad, Jedi Jul 28 '17 at 20:41

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 5
    I'm voting to close this question as off-topic because it is a purely legal question. There is no technical limitation to use the same certificate with multiple servers or with multiple instances. And if there are any legal limitations you should check with the CA where you've bought the certificate from. – Steffen Ullrich Jul 28 '17 at 15:07
1

This is not legal advice, if in doubt consult the provider or seek professional advice.

In my conversations with CAs I have found they generally consider a discrete instance of a server as the unit of licensing. That is, if it is one kernel. Multiple instances of Apache, Nginx, LDAP services, SFTP services all count as one server. If they can all be addressed by the same name on that single server, it is legal to use the certificate for multiple services.

The other alternative is a single load balancer/TLS offload device in front of your servers. Even if there are five servers behind the TLS offload (ie non-encrypted communications behind it to the servers, encrypted to the outside world), each device is considered a single server. So a two-device load balance cluster that perform TLS offload, is two servers, even if they then serve five servers behind them.

While checking for compliance is difficult for CAs to perform, do not think that you can "get away with it" just because your service looks like a single server to the outside world. Contact the person who purchased it for a copy of the license/terms of use for the service to make sure.

In the end, like any IT procurement, there needs to be a business case that justifies the expenditure, and if less than $100 per server per year is not worth it to secure your services where multiple servers are not allowed in the license, free options like Let's Encrypt can be considered.

  • Feel free to mark the answer as correct :) – Liam Dennehy Jul 28 '17 at 12:45
0

You can get a certificate for any servers you own, there's no legal problem with that. A certificate is just a file, after all. You can use the same certificate on any port, it does not matter.

If you have a certificate for *.you.io (called a wildcard certificate), you can get a bunch of VPS's (e.g. vps1.you.io, vps2.you.io, vps928.you.io), on any provider you want (Azure, AWS, DigitalOcean), put the same certificate on them, and they will be valid, whatever the port you choose.

If one registrar does not allow you do use the same certificate on more than one server or port, buy the certificate from another one. There's no technical reason not to allow that, other than making you pay twice.

And as Liam said, Let's Encrypt is issuing everyone certificates for free, so go there and get one. And they plan to start issuing wildcard certificates later this year, so one certificate will suffice to protect any server in your domain.

All my domains are from them. Except for the fact that they currently expire in 60 days, they work as good as any premium advanced enterprise TLS certificate.

Not the answer you're looking for? Browse other questions tagged or ask your own question.