1

I have just a single domain. I have 1 reverse proxy (l7 load balancers) and 3 webservers serving www.example.com

I am getting an ssl pro certificate for the domain and I want to understand the number of licenses I will need.

Let's assume that self-sign cert is out of the equation for the entire path between client <-> lb <-> webservers

choice 1) cert on loadbalancer only, communication between loadbalancer <--> backend webserver is pure http.

choice 2) cert on loadbalancer, cert on webservers

client <-> lb <- webserver> all https

=============================

For choice2, can I just use 1 cert and install the same cert+ptvkey+intermediacert on the loadbalancer and all the webservers?

Is the number of licenses required for a domain a pure commercial restriction or are there really some technical parameters in the cert itself that restrict the no of servers that can use it?

closed as off-topic by Steffen Ullrich, Bacon Brad, Xander, Tobi Nary, Steve Aug 29 '17 at 13:06

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Bacon Brad, Xander, Tobi Nary, Steve
If this question can be reworded to fit the rules in the help center, please edit the question.

  • What kind of licenses you are talking about? Do you mean certificates? There is no technical restriction for using the same certificate on multiple systems. – Steffen Ullrich Aug 28 '17 at 17:45
  • @SteffenUllrich yeap, I am talking about ssl certificates for usage on websites. Saw from Symantec website, it is 1 cert per server. – Noob Aug 29 '17 at 2:48
  • I have no idea what this license should be for and I cannot find anything about this on a quick search at a Symantec site (they offer lots of products). Please add a clear reference to what kind of license you refer to, i.e. link to the description on the product page of the vendor, cite the part of the product page etc. Apart from that again, there are no technical limitations on how many systems a certificate can be used. – Steffen Ullrich Aug 29 '17 at 4:31
  • Questions about a vendors licensing requirements are questions for the vendor. – schroeder Aug 29 '17 at 8:13
1

can I just use 1 cert and install the same cert+ptvkey+intermediacert on the loadbalancer and all the webservers ?

Yes, you can use single purchased certificate on all affected components (load balancers, proxy, web servers) as long as they serve the same domain name. You don't need to purchase separate certificate (with the same name) for each component.

  • I am seeing -> "Unlimited server licenses" feature in 1 of the ssl sites. why is this even a "feature" if a cert can be installed in all affected components of the same domain name ? – Noob Aug 29 '17 at 2:22
  • and now in Symantec live chat -> the sales rep said " only physical servers (actual servers) would need to have the certificate installed on it. If you have additional physical server, then there will be additional server licence required for Symantec certificates" – Noob Aug 29 '17 at 2:56
  • Sales are sales. From my understanding, by license they mean an unique key pair for specified domain. Like if you would use separate certificate and key pair for each component. I wouldn't bother with this, just export your cert to PFX and copy it to all target servers that will serve specified domain name. – Crypt32 Aug 29 '17 at 4:33
  • Technically one license is necessary. A company issuing certificates may, however, demand more money. In practise, they will be able to check this but may never do so. – Ned64 Aug 29 '17 at 8:31

Not the answer you're looking for? Browse other questions tagged or ask your own question.