Safe Use of Multi-Server Digital Certificates
The practice of using a single certificate to protect multiple servers has become more common, because of the reduced cost of certificate acquisition, and the ease of management that it entails.
Risks
However, this practice necessitates exporting the key-pair from one machine and importing it into one or more other machines. The procedure necessarily entails a reduction in assurance, because the private key exists in multiple locations. At the same time, the value of that one private key is much greater because it protects more resources.
Attacks
There are two main attacks facilitated by multi-server certificates:
- Eavesdrop: where an insider has the ability to intercept user traffic
- Impersonation: an attacker impersonates a genuine resource in the domain
Properly managed, multi-server certificates can provide increased flexibility. However, they also increase the probability of eavesdrop and impersonation attacks. Entrust recommends using proper safeguards when deploying multi-server certificates. For a more detailed analysis, please read our white paper entitled, "The Safe Use of Wildcard & Multi-Server Certificates."