2

We have a simple system with a REST service (WebAPI) that will be hosted on one machine (hosted on IIS on a custom port, port numer 3031) and with a website hosted on another machine that will be talking to the service.

We want both to use SSL, so as I understand we will need to purchase two separate SSL certificates for the production deployment on the Internet.

Does that sound right?

If so, then I don't know how do I request and purchase a certificate for the WebAPI REST service... The service will be hosted on a custom port 3031, should I purchase a normal certificate for the domain name of the machine where the service will be hosted? And then should I basically install the certificate on the IIS on that machine (like it's described here: https://docs.microsoft.com/en-us/aspnet/web-api/overview/security/working-with-ssl-in-web-api).

How will I be able to perform a verification of the domain for the purchased certificate if I'm going to use the certificate for a REST service on a custom port? (not for a regular website).

Apologies for my ignorance, I have searched the forum to find an answer to my issue, but I didn't find one, maybe it's because my very limited knowledge about certificates and security.

Improve this question

1 Answer 1

Reset to default
1

Your options is to:

  1. Make self signed certificate for API-machine, add this certificate to list of trusted certificates on webapp machine;
  2. Make worldwide-valid certificate for API-machine for free with LetsEncrypt (no ads, they're de-facto standard now).

There is no differense, which port does your service resides on. Certificate proves Common Name (CN) - and when it comes to HTTPS, it can be either server's domain name (https://example.com:3031 for certificate's CN example.com) or IP-address (https://11.22.34.56:3031 for certificate's CN 11.22.34.56)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .