0

Let say:

  1. application.house.com   apache tomcat         : physical server
  2. email.house.com         apache tomcat         : virtual 
  3. finance.house.com       Oracle Wallet Manager : physical server 
  4. document.house.com      apache httpd          : physical server 
  5. room.house.com          IIS 7 : windows       : physical server 
  6. person.house.com        apache tomcat         : virtual 
  7. portal.house.com        apache                : physical server        

Assume: portal.house.com domain will be common subject name for that SAN Certificate and the rest of domains will be in Subject Alternative Name extension.

For Certificate Signing Request(CSR),I will generate a CSR at apache server using openssl included FQDN domain in SAN extension. Is it enough?

Can each domain of every server recognize this type of certificate after that?

  • For HTTPS, if SAN extension is present it should be used and Subject ignored, so portal.x might be in Subject for (old) clients that ignore SAN, but all names including portal.x should be in SAN for clients that use SAN. (Nitpick: it's Common-Name in Subject, or Subject Common-Name, but not Common Subject Name.) Also, putting SAN in the request (CSR) won't necessarily get it in the cert; check CA doc or instructions on that. – dave_thompson_085 Sep 24 '14 at 13:15
2

Yes.

You can use OpenSSL to convert the certificate into different formats as required by the application / server.

I've seen Apache / Tomcat configured a number of ways. Sometimes with a .pfx, sometimes with .pem files, and sometimes using the Java keystore.

IIS typically uses .pfx files.

With that being said, you want to make sure that your CA allows you to install the certificate on multiple servers without requiring additional compensation to be covered legally.

1

Yes, you can buy one certificate and use it on unlimited number of servers. However, some servers may require you to convert the certificate and the private key into an appropriate format. You may look into documentation to find the details for each program.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.