Hello,

  I don't think there is one correct answer to this question. It depends on the services and how those hosts and services are managed. 

  From a security perspective you need to have confidence that your private keys are secure and have not been been compromised. So if the services are administered by different teams or people it is better to separate the keys and control access to them  so that each team and service would have access only to their own keys. Meaning it is better to have a certificate for each service. This will not save you if one of the keys gets compromised, but it is better to figure out how it happened and who is responsible if/when it does. It is a good idea if these certificates are with a different subject name because when one is expiring or there is some issue with it it is easier to understand which one it is. The OU field in the subject DN is a good way to separate these.

  If the server and all its services are managed by a single team/person and the impact of key compromise is not that severe then having one certificate for multiple services can be simpler to manage. All services will have access to the same private key. This has the effect that when a key does get compromised you will have a hard time figuring out how or through which service it could have happened.

Just my 2c,
Ahti



Kontakt lejeczek via FreeIPA-users (<freeipa-users@lists.fedorahosted.org>) kirjutas kuupäeval T, 8. veebruar 2022 kell 20:40:
Hi guys.

I ponder what I think must be trivial for at the same time,
also an obvious idea - services & hosts.
All the hosts, domain members and all possible or maybe just
a handful services, one might run on those hosts - should
you want a unique certificate for each host+service or
perhaps a single cert for a host which then be used by all
services on the host, is a better practice?

All ideas & notions shared are greatly appreciated.
many thanks, L.
_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure