2

We have a simple system with a REST service (WebAPI) that will be hosted on one machine (hosted on IIS on a custom port, port numer 3031) and with a website hosted on another machine that will be talking to the service.

We want both to use SSL, so as I understand we will need to purchase two separate SSL certificates for the production deployment on the Internet.

Does that sound right?

If so, then I don't know how do I request and purchase a certificate for the WebAPI REST service... The service will be hosted on a custom port 3031, should I purchase a normal certificate for the domain name of the machine where the service will be hosted? And then should I basically install the certificate on the IIS on that machine (like it's described here: https://docs.microsoft.com/en-us/aspnet/web-api/overview/security/working-with-ssl-in-web-api).

How will I be able to perform a verification of the domain for the purchased certificate if I'm going to use the certificate for a REST service on a custom port? (not for a regular website).

Apologies for my ignorance, I have searched the forum to find an answer to my issue, but I didn't find one, maybe it's because my very limited knowledge about certificates and security.

1

Your options is to:

  1. Make self signed certificate for API-machine, add this certificate to list of trusted certificates on webapp machine;
  2. Make worldwide-valid certificate for API-machine for free with LetsEncrypt (no ads, they're de-facto standard now).

There is no differense, which port does your service resides on. Certificate proves Common Name (CN) - and when it comes to HTTPS, it can be either server's domain name (https://example.com:3031 for certificate's CN example.com) or IP-address (https://11.22.34.56:3031 for certificate's CN 11.22.34.56)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.