5

I want to enable SSL for all web applications. Can I use single certificate to do this or do I need one certificate for each web application in my farm? Please share any tutorial if possible?

1 Answer 1

5

Yes it is possible to use a single certificate. This needs to be a wildcard certificate. It can be a "Domain Certificate" as well as a certificate from a cert service as Verisign.

Example:

Your web applications in SharePoint could be like this.

my.domain.com

teams.domain.com

documents.domain.com

The wildcard certificate must be for *.domain.com.

It is as well possible to use single certificates for every web application. I would prefer the wildcard-certificate solution.

Go to your SharePoint web frontend server. That is the server hosting your web applications. Open "Internet Information Services (IIS) Manager". Click onto the servername in the left pane. Doubleclick "Server Certificates" on the middle pane. You will see your certificates imported to the web server here. On the right pane you will see the possible actions to import a bought cert or to create a domain signed cert. Just follow the wizard.

enter image description here

When your certificate in available in the "Server Certificates" list you can go to the next an final step.

Expand "Sites" on the left pane. Click onto the web application you want to use with ssl. On the right pane you select "Bindings". Add a binding and refer to the following screenshot.

1) set connection type to https 2) either set the IP address of the site or the hostname (URL) 3) select the certificate you uploaded/created before

enter image description here

Now your site is available in https/ssl. You can try to open sites on that web application with ssl now.

Repeat this steps for all of your web applications.

Check Central Administration - Application Management - Web Applications - Alternate Access Mappings afterwards. You can remove the "http" bindings to prevent users from using http to open SharePoint.

Using a bought certificate is recommended because it is accepted by all types of client devices. Domain signed certificates must be trusted by all client devices.

5
  • A wildcard certificate is not required. In fact, you could have 3 certificates and that would work just fine, as well. You'd just need to enable SNI if you choose to use separate certificates on the same IP:Port combination. You can also use UCC certificates (one certificate with multiple domains).
    – user6024
    Jul 17, 2018 at 14:46
  • 1
    @TrevorSeward That is right. He asked for the ability to use only one single certificate in this case.
    – PhilFancy
    Jul 18, 2018 at 4:57
  • @TrevorSeward, this is very helpful.
    – kumar
    Jul 18, 2018 at 14:18
  • @TrevorSeward: Do you know any current drawbacks when using SNI and SharePoint? Some time ago, it wasn't really a good idea, e.g. WebDAV and Windows7.
    – MHeld
    Jul 24, 2018 at 14:22
  • SNI works fine in SharePoint. I've never had any issues. Jul 24, 2018 at 15:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.