# SSL for proxy-reverse server **URL:** \ **Category:** Help\ **Created:** [July 27, 2018, 8:40pm UTC](https://community.letsencrypt.org/t/ssl-for-proxy-reverse-server/67853 "2018-07-27T20:40:44Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![BrunoIurko](https://avatars.discourse-cdn.com/v4/letter/b/e0b2c6/32.png) [@BrunoIurko](https://community.letsencrypt.org/u/BrunoIurko)\ **Post date:** [July 27, 2018, 8:40pm UTC](https://community.letsencrypt.org/t/ssl-for-proxy-reverse-server/67853/1 "2018-07-27T20:40:44Z")
Hello people. I would like to ask a question that we work here in my company with DMZ, we have a reverse proxy server, I would like to create a single ssl for all the sites behind this server, will I have to create an ssl by subdomains? or only 1 for everyone is already good? Sorry, I used google translate ---
**Author:** ![stevenzhu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stevenzhu/32/18864_2.png) [@stevenzhu](https://community.letsencrypt.org/u/stevenzhu)\ **Post date:** [July 27, 2018, 8:53pm UTC](https://community.letsencrypt.org/t/ssl-for-proxy-reverse-server/67853/2 "2018-07-27T20:53:44Z")
Hi, > [@BrunoIurko](#): > > single ssl for all the sites behind this server, It depend on your need... And how many site you need to cover on that server.... Are all sites on one root domain? (If so, you could take advantage on leus Encrypt's wildcard certificate...) If not all sites on the same root domain, you could just issue one (wildcard) certificate for each dedicated root domain, to save time renewing & protect privacy... Thank you ---
**Author:** ![BrunoIurko](https://avatars.discourse-cdn.com/v4/letter/b/e0b2c6/32.png) [@BrunoIurko](https://community.letsencrypt.org/u/BrunoIurko)\ **Post date:** [July 27, 2018, 8:59pm UTC](https://community.letsencrypt.org/t/ssl-for-proxy-reverse-server/67853/3 "2018-07-27T20:59:37Z")
Thank you, Example, [s.site.com](http://s.site.com) ip: 192.168.1.220 httpD [p.site.com](http://p.site.com) ip 192.168.1.158 TomCat with the wildcard certificate, can I protect both cases? \ ServerName [s.site.com](http://s.site.com) SSLProxyEngine On SSLEngine On SSLCertificateFile SSLCertificateKeyFile SSLCertificateChainFile ProxyPreserveHost On ProxyPass / [http://192.168.1.220:443](http://192.168.1.220:443) ProxyPassReverse / [https://s.site.com/](https://s.site.com/) \ ServerName [p.site.com](http://p.site.com) SSLProxyEngine On SSLEngine On SSLCertificateFile SSLCertificateKeyFile SSLCertificateChainFile ProxyPreserveHost On ProxyPass / [http://192.168.1.158:443](http://192.168.1.158:443) ProxyPassReverse / [https://p.site.com/](https://p.site.com/) ---
**Author:** ![stevenzhu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stevenzhu/32/18864_2.png) [@stevenzhu](https://community.letsencrypt.org/u/stevenzhu)\ **Post date:** [July 27, 2018, 9:13pm UTC](https://community.letsencrypt.org/t/ssl-for-proxy-reverse-server/67853/4 "2018-07-27T21:13:37Z")
> [@BrunoIurko](#): > > [s.site.com](http://s.site.com) ip: 192.168.1.220 httpD > [p.site.com](http://p.site.com) ip 192.168.1.158 TomCat Of course, you could use one single wildcard certificate to cover all subdomains. (\*.site.com) But, please note that the only way to get the certificate is via DNS validation, which means you would need to use a competable DNS provider in order to automate the process. (Try acme.sh or certbot.... In Unix system, acme.sh usually covers more DNS provider than certbot...) Thank you ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [August 26, 2018, 9:13pm UTC](https://community.letsencrypt.org/t/ssl-for-proxy-reverse-server/67853/5 "2018-08-26T21:13:39Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.