SSL Certificate for 1 Site [closed]

Question

Closed. This question is off-topic. It is not currently accepting answers.

---

Want to improve this question? Update the question so it's on-topic for Stack Overflow.

Closed 8 years ago.

Improve this question

Can someone help me understand if I have 1 domain

www.example.com

which runs lampp on port 80 and tomcat on port 8080 ,

do I need 1 or 2 SSL certificates?

for example the commercial site runs on www.example.com but the actually web application runs on www.example.com:80/Login/

Does that mean I need 2 separate SSL EV Certificates or can I just purchase 1 and load it on both apache and tomcat because its the same domain?

Thanks

Answer 1

Firstly, you're probably not running your servers using SSL on ports 80 and 8080. Port 80 is the default port for HTTP whereas port 443 is the default port for HTTPS.

Tomcat tends to use port 8080 for its HTTP service and port 8443 for its HTTPS service because it tends to be run by a non-root user on Unix boxes (which can't use port numbers under 1024), and also perhaps because ports 80 and 443 tend to be taken by other services (e.g. Apache Httpd) already.

While you could technically run an HTTPS service on port 80, it's not a good idea, since you would have to specify the port in the address every time (and possibly resort to port unification if you want to run a plain HTTP service on that port too). This would lead to unnecessary confusion.

Host name verification for HTTPS is bound to host names, not port numbers. Whichever ports you use doesn't really matter. You could run both https://www.example.com/ (implicitly on port 443) with Apache Httpd and https://www.example.com:8443/ with Apache Tomcat using the same certificate, issued for www.example.com (at least). You may have to convert the storage format for the keys and certificate (Apache Httpd would use separate key and certificate files, whereas Tomcat would use a single keystore, e.g. in PKCS#12 format), but that's just a matter of converting the files on your end once the CA has issued the certificate.

In addition, it's quite unusual to use HTTPS on both Apache Httpd and Tomcat on the same machine. Typically, you'd set up your system with Apache Httpd on port 443 to handle the SSL connections, and set up a reverse proxy to have Apache Httpd dispatch the requests to your Tomcat in plain HTTP on localhost. This allows for everything to be served on https://www.example.com/ without needing to specify a non-default port. Only the front-end (Apache Httpd) would need to be configured with the certificate.