Generating certificate CSR for multiple servers

[kamram (Kam754)]

Hi,

We are planning to purchase a new wildcard certificate for our internal servers:
server1.domain.com
server2.domain.com
server3.domain.com
etc.

We need to generate a CSR request to get the cert.
Which server should the CSR be generated on if we have multiple servers that will be using this cert? (all of them are Windows 2012R2/2016 servers with IIS)

Thank you!

[alexdavidson8771 (Alex7508)]

You can generate the CSR on any of the servers as they are all going to be covered by *.domain.com

having just gone through this to get our current wildcard certificate set up on our sonicwall this was what I did - although it seems too simple to be correct!

Generated the CSR for the wildcard cert on server A (in our case, exchange) for *.domain.com
Imported the certificate to that server once the request was successful
Exported the certificate from server A (in our case exchange) - the export from the server should give you the option to export both the certificate and private key, and you’ll need to put a password in (which can be anything you like for now)
Take that exported certificate and import it onto server B, remembering to also supply the import procedure with the password you used when exporting

You should be able to repeat the import using that same exported/password comb on any/all servers that meet the criteria of *.domain.com

As far as I can see there’s nothing wrong with that setup, and the only downside I can see is that when it comes time to renew you’ll need to generate the renew request from server A, then re-export the certificate once it’s re-validated and import it back onto the other servers it’s been deployed on. Although I’ve not had to deal yet with renewing a certificate that has been deployed elsewhere so there might be an easier way to do that

[anon73201645]

To avoid wildcards, you could create the CSR on server1 and add server2 and 3 to the SAN (=Subject Alternative Name) of the certificate request.

I always use an inf file to be read by certreq to create the CSR. That way you are in complete control of the content of the CSR.

Have a look at Microsoft Docs .

[darren-for-cdw]

Both these posts are fantastic.

Nice work guys!