We have two machines that serves a website via HTTP. The webiste/domain has two "A" records, that is how the load is round-robinly distributed.

We want to have HTTPS for this website. The problem is that, the different machines that hosts this website are maintained by different people. Is there any method to have an HTTPS cert on both machines for one domain? Does Letsencrypt support this setup?

Any trick/method to harden this setup? E.g. if one machine is compromised, the other shouldn't be. So if the cert is stolen from one, any prevention for the domain for wrong use? Maybe PFS could help?

  • I will not take any specific CA into account but this should be very straight forward? Let people A create a private key and request a certificate and then let people B to the same. Two certificates with different keys for the same name. There is nothing to stop you from doing this. The crux is for both people A and B to prove to the CA that they own the domain name. – Peter Jan 24 '18 at 12:23
  • As a note, I've run into an issue in the past where certain versions of Java have an https library that keeps track of which cert was used for a domain and throws an exception if it changes (in an attempt to prevent MitM attacks). – Xiong Chiamiov Jan 24 '18 at 17:16

Can one domain have multiple servers controlled by different entities

Yes, but there will need to be some coordination for getting the SSL certificates

How can the coordination work (depends on the ACME challenge used)

  • HTTP

    • Working together

      Whenever one of the 2 hosts wants to renew a cert they would need to deploy a .well_known file to both servers, so that no matter which one letsencrypt access they get the right file.

    • Centralised

      You can run an additional server, which both parties can push files to, and have both servers redirect any requests for .well_known to this server

  • DNS

    • Full access

      Either of the 2 hosts would need to be able to add DNS records to pass the checks

    • Custom API

      An API can be setup so that the 2 hosts can submit an ACME response and have it served

Limiting impact of breaches

As the servers need to be able to generate SSL certificates if they are breached they will be able to generate certs.

Using Must-Staple the impact of current certs leaking can be reduced, but this will not help if the host is instructed to make new certs without this after generation.

Using CT logs you can watch for invalid certs, and using CAA you can limit which CAs will issue certs, which will help reduce the breach impact.

You could even use CAA to disable certs entirely, and only allow issuance by contacting you and manually removing the record until the cert has been issued, reducing your attack window, but increasing the management overhead.

| improve this answer | |

You can use different certificates for the same domain and different machines. It is not explicitly supported by Let's Encrypt but you can get different certificates for the same domain from the too if you provide different CSR. But note that it will be hard to automate the certificate update in such a setup because the validation of the requests needs either changes on the web site on both machines or on the DNS. This means that even if both machines are administrated by different admins they somehow need to work together to make it possible for the others to renew the certificate for his machine.

Also, if the attacker has access to one certificate (i.e. compromised it on one machine) this stolen certificate could be used with MITM attacks as long at is not revoked and also known to be revoked by the clients. But browsers often do no or no proper revocation checks. It also does not matter in this case if the second machine still has another certificate since it is enough that the attacker has one valid certificate for the domain. Also, if the machine is compromised it is very likely that the attacker could get more certificates for the domain from Let's Encrypt.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.