Solved: is it possible to use single ssl certificate for multiple server farm with different FQDN?

KFU NOC · ‎06-29-2010

Hi

We generated the CSR request for versign secure site pro certificate SSL Certificate for cn=abc.com considering abc.com as our major domain. now we have servers in this domain like www.abc.com, a.abc.com , b.abc.com etc. we installed the verisign certificate and configured ACE-20 accordingly for ssl-proxy and we will use same certificate gerated for abc.com for all servers like www.abc.com , a.abc.com , b.abc.com etc. Now when we are trying to access https//www..abc.com or https://a.abc.com through mozilla , we are able to access the service but we are getting this message in certfucate status " you are connected to abc.com which is run by unknown "

And the same message when trying to access https://www.abc.com from Google Chrome.

"This is probably not the site you are looking for! You attempted to reach www.abc.com, but instead you actually reached a server identifying itself as abc.com. This may be caused by a misconfiguration on the server or by something more serious. An attacker on your network could be trying to get you to visit a fake (and potentially harmful) version of adgate.kfu.edu.sa. You should not proceed"

so i know as this certficate is for cn=abc.com that is why we are getting such errors/status in ssl certficate.

Now my question is

1. Is is possible to remove above errors doing some ssl configuration on ACE?

2. OR we have to go for VerisgnWildcard Secure Site Pro Certificate for CSR generated uisng cn =abc.com to be installed on ACE and will be used for all servers like www.abc.com , a.abc.com etc..

Thanks

Waliullah

Sean Merrow · ‎06-29-2010

Hi Wali,

You will either need a separate certficate for each unique FQDN, or a wildcard cert that will match all of them. That is the only way the browser will not complain to the end user.

Sorry for the confusion.

Sean

View solution in original post

Sean Merrow · ‎06-29-2010

If you want to use the same VIP and port number for multiple FQDNs, then you will need to get a wildcard certificate. Currently, if you enter www.abc.com in your browser, that is what the browser expects to see in the certificate. And right now it won't beause your certificate is for abc.com. You need a wildcard cert that will be for something like *.abc.com.

Hope this helps,

Sean

KFU NOC · ‎06-29-2010

Hi Sean

Thanks for your reply! we rae not sharing VIPS , we have dedicated VIP for each FQDN , so in this case is it possible ? to use the single certificate generated for cn=abc.com to be used with www.abc.com , a.abc.com etc and not getting any cn name issue in certificate.

Thansk

Wali

Sean Merrow · ‎06-29-2010

Hi Wali,

You will either need a separate certficate for each unique FQDN, or a wildcard cert that will match all of them. That is the only way the browser will not complain to the end user.

Sorry for the confusion.

Sean

KFU NOC · ‎06-29-2010

Oki Thanks sean! now things are clear .