SSL working within ServiceGuard

[David Land]

I am about to setup SSL on my production UNIX servers which are configured in a 2 node clustered environment. I have two questions I was hoping you guys could help me with.

I was wondering if SSL would work within the ServiceGuard environment?

If it works within the ServiceGuard environment, then it will be installed on the shared storage. Once installed, I will contact our CA to request a certificate for Secure FTP. I have heard that we have to provide a hostname of the server. I wanted to know if a certificate would work on the "virtual" failover hostname from ServiceGuard?

Thanks for any and all help

[Matti_Kurkela · Accepted solution]

The SSL certificate is primarily tied to a DNS Name. If you have set up your DNS correctly for the package IP address(es), the SSL certificate will work just fine.

There is actually nothing "virtual" about the ServiceGuard package's IP address: it's just an IP address that happens to move between two or more servers. The fact that it moves makes no difference to the DNS hostnames.

There are no technical reasons that would prevent you from copying the SSL certificate and its private key. Only the agreement between you and the CA may limit you to using the certificate on one server at a time.

Actually, the server usually does not care much about the SSL certificate it uses. Once we equipped a test server with a load balancer that does a kind of NAT. It had SSL certificates from our internal test CA. Because of the load balancer, the server's IP address changed and the load balancer was set up in the server's old IP address.

No change of the certificates was needed, even though the actual server was using completely different address: from the viewpoint of the client, nothing was changed!