2

We are using two Debian servers in our company (with apache 2 as httpd) and our services are split between those two of them. One server has the website, the other has some minor sites under subdomains.

The idea was two use the obtained wild card certificate on both server to secure all our websites. I this possible, even though I only used one server to create the private/public keys, from which the public key was submitted to rapidssl to get the necessary certificates?

So can I just copy the private/public key to other server and install the rapidssl certificate there without problem as well?

Improve this question

1 Answer 1

Reset to default
4

Yes, this is possible and it is often used in practice.

The certificate is only bound to the private key and not to a machine. And the private key is not bound to machine too so you could take it to more machines. But you should be aware that the wider you propagate the private key the harder it will be to protect it. And without proper protection it might not be private for long.

Improve this answer
6
  • Note that some certificate providers' contracts limit the number of servers on which the certificate can be used. It's a commercial limit not a technical limit, and the certificate will work, but you may be in breach of your contract. You need to read the small print.
    – Mike Scott
    Commented Jul 7, 2015 at 13:23
  • Also note, that breaching the SSL certificate contract may void CA's warranty most times, which can lead such company into serious financial trouble, if someone will steal or brute force the private key and use it to create MITM attack.
    – Tomasz Klim
    Commented Jul 7, 2015 at 13:40
  • @TomaszKlim: I don't think that this has anything to do with a warranty of the CA. This warranty usually covers only the case where the CA issued the certificate wrongly and users got harmed by that. This would not be the case if you reuse the certificate on multiple machines, since it does not change anything about how valid the issuing of the certificate was.
    – Steffen Ullrich
    Commented Jul 7, 2015 at 14:01
  • @MikeScott: Link plz!
    – StackzOfZtuff
    Commented Jul 7, 2015 at 14:04
  • @Steffen Ullrich it's true that security warranty given by CAs about has nothing to do with breaching contract for the number of machines to deploy a certificate. However such agreement provisions in fact exists. Maybe simply because CAs can force them. And probably not all CAs. But still...
    – Tomasz Klim
    Commented Jul 7, 2015 at 14:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .