3

I want to enable SSL for all web applications. Can I use single certificate to do this or do I need one certificate for each web application in my farm? Please share any tutorial if possible?

5

Yes it is possible to use a single certificate. This needs to be a wildcard certificate. It can be a "Domain Certificate" as well as a certificate from a cert service as Verisign.

Example:

Your web applications in SharePoint could be like this.

my.domain.com

teams.domain.com

documents.domain.com

The wildcard certificate must be for *.domain.com.

It is as well possible to use single certificates for every web application. I would prefer the wildcard-certificate solution.

Go to your SharePoint web frontend server. That is the server hosting your web applications. Open "Internet Information Services (IIS) Manager". Click onto the servername in the left pane. Doubleclick "Server Certificates" on the middle pane. You will see your certificates imported to the web server here. On the right pane you will see the possible actions to import a bought cert or to create a domain signed cert. Just follow the wizard.

enter image description here

When your certificate in available in the "Server Certificates" list you can go to the next an final step.

Expand "Sites" on the left pane. Click onto the web application you want to use with ssl. On the right pane you select "Bindings". Add a binding and refer to the following screenshot.

1) set connection type to https 2) either set the IP address of the site or the hostname (URL) 3) select the certificate you uploaded/created before

enter image description here

Now your site is available in https/ssl. You can try to open sites on that web application with ssl now.

Repeat this steps for all of your web applications.

Check Central Administration - Application Management - Web Applications - Alternate Access Mappings afterwards. You can remove the "http" bindings to prevent users from using http to open SharePoint.

Using a bought certificate is recommended because it is accepted by all types of client devices. Domain signed certificates must be trusted by all client devices.

  • A wildcard certificate is not required. In fact, you could have 3 certificates and that would work just fine, as well. You'd just need to enable SNI if you choose to use separate certificates on the same IP:Port combination. You can also use UCC certificates (one certificate with multiple domains). – Trevor Seward Jul 17 '18 at 14:46
  • 1
    @TrevorSeward That is right. He asked for the ability to use only one single certificate in this case. – PhilFancy Jul 18 '18 at 4:57
  • @TrevorSeward, this is very helpful. – kumar Jul 18 '18 at 14:18
  • @TrevorSeward: Do you know any current drawbacks when using SNI and SharePoint? Some time ago, it wasn't really a good idea, e.g. WebDAV and Windows7. – MHeld Jul 24 '18 at 14:22
  • SNI works fine in SharePoint. I've never had any issues. – Nullldata Jul 24 '18 at 15:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.