2

I did an on-premise setup for Sitecore 9.3 XP Scaled environment. At the time of installation I created separate certificates using createcert.json file and common xconnect certificate thumbprint for all the instances.

Now going forward in production (which is also an On-Premise environment) we have to use one certificate provided by our IT team.

I did an installation with this single certificate thumbprint for all instances including xconnect. So here are my installation instances.

This certificate subject identifier is defined as uatcm.company.com

uatcm.company.com:433 (CM)
uatcm.company.com:1221 (xconnect collection)
uatcm.company.com:1222 (xconnect collection search)
uatcm.company.com:1223 (xconnect marketing automation)
uatcm.company.com:1224 (xconnect marketing automation report)
uatcm.company.com:1225 (processing)
uatcm.company.com:1226 (reporting)
uatcm.company.com:1227 (reference data)
uatcm.company.com:1228 (cortex processing)
uatcm.company.com:1229 (cortex reporting)

I have installed the CD instance and the 4 necessary certificates including thumbprint in connectionstring.config in CD machine and I am able to connect to these services with https.

My question is - is this a valid setup (using port numbers) ? If we need to create separate bindings so can we add these domains in one certificate and use it for all?

Right now I am getting FORBIDDEN 403 issue when I browse for Experience Analytics in my CM instance

Improve this question
1
  • Using single certificate is fine. But make sure you update the certificate thumbprint in all connection string files
    – SitecorePro
    Commented Sep 26, 2022 at 21:14

1 Answer 1

Reset to default
1

Sitecore recommends a separate certificate for each instance to make it more secure and to limit the damage that could be done should a certificate be compromised.

That being said, I believe it is still valid to use a single certificate on multiple instances. I have seen one single wildcard certificate be used for all CM,CD, Proc, Rep and individual XConnect instances.

If you are experiencing issues with 403 forbidden, I recommend that you ensure each sitecore and Xconnect role has permission to access the private key for the certificates that it needs access too.

To do this, run MMC => navigate to correct certificate store. Right click => Manage private key.

Make sure for example the iis instance you are using has permission to access.

i.e. iis apppool\yourapp.cm

EDIT: apologies I didn't fully read your question regarding port numbers... I think you are over complicating the issue by using port numbers, I think you will come I to problems that way. Instead you could either use single wildcard certificate, or add multiple "subject alternative names" SANs to the same single certificate, and still use the one certificate.

Improve this answer
1
  • Thanks Dean. Apologies for late reply. We will try to get the certificate with multiple SANs. I have upvoted and accepted this as answer.
    – Amin Sayed
    Commented Sep 28, 2022 at 7:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.