To consolidate three SSL websites with the same content into a single, load-balanced SSL virtual server, which binding approach is appropriate?

To consolidate three SSL websites with the same content into a single, load-balanced SSL virtual server, which binding approach is appropriate?

• A. Bind the certificate of each website to a single SSL virtual server
• B. A wildcard certificate to a single SSL virtual server
• C. A multiple SAN certificate to a single SSL virtual server
• D. A wildcard certificate to a content-switching virtual server

Answer: (C)

To serve multiple domains from a single load-balanced SSL vserver, the TLS certificate must cover all the domain names clients will request. A SAN (Subject Alternative Name) certificate lists several DNS names in one certificate, so binding a single SAN certificate to that SSL vserver lets you terminate TLS once and route requests for all three sites to the same backend pool. Wildcard certificates only help if all sites share a common base domain (like subdomains of one domain); if the sites are different domains, a wildcard won’t cover them all. A wildcard on a content-switching vserver wouldn’t satisfy the need to terminate TLS for all the hostnames on one SSL vserver. Using a SAN certificate provides the right, single-certificate solution for multiple domains.

To serve multiple domains from a single load-balanced SSL vserver, the TLS certificate must cover all the domain names clients will request. A SAN (Subject Alternative Name) certificate lists several DNS names in one certificate, so binding a single SAN certificate to that SSL vserver lets you terminate TLS once and route requests for all three sites to the same backend pool. Wildcard certificates only help if all sites share a common base domain (like subdomains of one domain); if the sites are different domains, a wildcard won’t cover them all. A wildcard on a content-switching vserver wouldn’t satisfy the need to terminate TLS for all the hostnames on one SSL vserver. Using a SAN certificate provides the right, single-certificate solution for multiple domains.