Keys for one domain with more than one server?

Let's Encrypt can issue you many certificates, subject to rate limits to let everyone share fairly

So you have basically two alternatives, you could use either of them, or a mixture of both

  1. You could ask for a separate certificate on each server, just covering the names used by that server. Each server will need to run "certbot" or other client software to obtain the certificate, both initially and then to renew these certificates every couple of months. Most people set this with a cron job or similar.

OR

2, Ask for one certificate covering all the names, or a large group of names, and then securely copy the associated keys and certificates to each server which needs them. For example with a script that calls scp or something.

For every name in every certificate you will need to be able prove to Let's Encrypt that you control this name. So that may be much easier to do in scenario 1 where the software asking for the certificate is running on the machine it needs to prove control of. On the web servers for example, you should be able to do the "http-01" challenge, where Let's Encrypt just wants to see a special file created in a particular URL on the web server with that name.

1 Like