Ssl certificates for a clustered environment

Question

Hi all,
I have a rather large domain in one environment with one Admin Server and 6 Managed Servers.
The Managed Servers are split on two physical machines with the first machine holding the Admin Server as well.
Each pair of servers is joined in a cluster, so I have 3 clusters, each hosting one application.
Now some of the communication needs to be done over ssl and I'm wondering about the configuration. First of all I should
note that these certificates won't be seen by a client (browser), they will only be used for internal application communication.
So, do I need one certificate for each managed server for his identity keystore? Or can I use the same certificate for all of them?
They will all be accessible under the same url, under a couple of layers of routers. If I use the same certificate can I use the one on the
router, which the clients see as well? Can I or Must I?

Answer 1

You only need to tell nodemanager where to find its certs. If you've already chosen SSL for your nodemanager, then by default it uses the democerts that come with WL. But you really don't want to use those...
So in your nodemanager properties, use something like:
# SSL Configuration
KeyStores=CustomIdentityAndJavaStandardTrust
CustomIdentityAlias=your_cert_alias
CustomIdentityKeyStoreFileName=full_path_to_your_identity_keystore_used_by_your_mgd_server
CustomIdentityKeyStorePassPhrase=your_storepass
CustomIdentityKeyStoreType=jks
CustomIdentityPrivateKeyPassPhrase=your_keypass
This tells your nodemanager to use the same identity as your managed servers. Since it's using java standard trust, it shares the same "cacerts" as the app server. In the console, your Machine -> Configuration -> Node Manager -> Type would be SSL.
So that would be all that's required for the nodemanager.
In your trust keystore, you can just add the signer / root ca cert for your certs, or you can add the individual server certs if you want to restrict the trust a little further. Normally identity certs expire more frequently than root certs, so I don't put identity certs into the trust store since it just means more maintenance when they expire.