I have a requirement to use open SSL for communication between a single standalone "windows server" and a "cluster" comprising 2 windows servers. The servers in the cluster will be load balanced and reachable via a virtual IP.
I need guidance on how to implement open ssl? I also need to understand if I need to install certificate on all servers in the cluster as any one of them could be talking to the standalone server.
Any documents, example configuration that can help me understand and implement open ssl would be helpful. I am familiar with theoretical concepts of cryptography and key pairs but not sure how to put it to work.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
The lniking to wndows 98 zone is incorrect.
So if we have a windows AD environment with PKI set up meaning CA, RA etc defined and I have a bunch of web servers that are nor part of the domain, can I still leverage the AD PKI so that they are accessbile via HTTPS and not HTTP. For webservers or application servers that are part of the domain, they will be handled by AD PKI but am unsure about the non domain computers requiring certificates for communcaition. Currenlty we use verisign issued certificates for these? So, I am trying to udnerstand what are my alternatives, if I dont want to use verisign. can I use AD? if not, can I use opessl?
To make my question more clear, let me give you an example.
If I have PKI set up using AD and I have a webserver in my DMZ accessible to the public which is not part of the domain. Can I generate a certificate using my AD CA and install it on the webserver? If so, are the external users accessing that webserver going to get a message that this site is not trusted or something like that?
Yes and yes. Every SSL connection needs a certificate, whether self-signed or commercial. You can use certs created by your own internal CA, but external users who do not have your CA's root cert installed in their trusted root CAs store will get a certificate error. The only difference with a Verisign cert is that their root CA cert comes preinstalled with Windows. A Windows CA, OpenSSL and Verisign all create (basically) identical certificates which all can be used, the only difference is the trusted root CA cert with Verisign and other commercial vendors.
Business Accounts
Answer for Membership
by: CoccoBillPosted on 2009-08-13 at 04:57:00ID: 25087170
I'm not sure I understand why it would need to be OpenSSL. You state windows servers but the question is linked to the windows 98 zone, what OS are the servers running?
About the connection itself, what protocol(s) do you need to implement SSL for, or do you mean an SSL VPN for all traffic?
> I also need to understand if I need to install certificate on all servers in the cluster as any one of them could be talking to the standalone server.
Yes, all nodes that you want to communicate using SSL need to have the certificates, in case of an active-active cluster both nodes must have it.