If I have three web servers that all have the same CSR based on a domain, *.domain.com, does that mean all the servers have the same private key? I know it's a short question, but I am not sure of the SO answers I have read.
What I didn't understand because I am still learning is if they don't all have the same private key for that *.domain.com, doesn't that mean I need to generate a new key for each server? I think what is getting me is I thought you could only have the same private key for the CSR based on the math, so it would have to be the same for each server in a domain wide CSR.
I do see that if I use one key on all that if one server gets compromised, they all do, but that doesn't help me because, again, I thought they all had to have the same key on a domain wildcard CSR.