I'm currently looking after an integration platform with SOAP based web service connections out to partner organizations. At the moment, the same SSL certificate is used for both transport level security (HTTPS over the public internet) and for message level signing and encryption in the SOAP payloads.
Is this typically considered bad practice? The immediate downside that comes to mind is the fact the key now exists in more than one place and is a little more vulnerable than if it was in one place. Compromising the key would break both the HTTPS and SOAP level security. Are there more issues to be aware of here? How is this handled in other places?