I am planning a small Sitecore 9.0.2 + Sitecore Experience Commerce production deployment for a demo website with very low traffic. I do not have a lot of time to provision multiple servers, so I plan to use the XP0 topology: SQL Server, Solr, xConnect, Sitecore website, Sitecore Experience Commerce 9 services all on the same VM.

I have read that you should not use self-signed certificates in production. I completely understand why for the Sitecore website. To avoid trust warnings in the browser. I will have my own domain demoname.companyname.com and wildcard SSL certificate for *.companyname.com that I will use for the Sitecore website.

However, as everything else will be installed locally, can I use self signed certificates for the xConnect, solr, and commerce services? What are the potential security concerns?

  • 1
    It's perfectly possible to deploy Sitecore 9 locally with self-signed certificate. That's a common setup for DEV environment. Have you looked at installation scripts/tools created by community? e.g. rockpapersitecore.com/2017/10/… flux-digital.com/blog/…
    – grg
    Commented Sep 18, 2018 at 11:05
  • I know that self-signed certificates are perfectly fine for Dev environments. I am already using SIF Less. But my question is about production environments. Commented Sep 18, 2018 at 11:17
  • Thanks for clarification. Since you already know how to use self-signed certificate for local deployments, then there is only security concerns to consider. I'm not a security expert, but what I read is that if certificate is compromised then your instance will susceptible to man-in-the-middle attack and certificate revocation will have to be done by each client, ie. it's not possible to revoke centrally as is the case for certificates issued by trusted authorities. social.msdn.microsoft.com/Forums/vstudio/en-US/…
    – grg
    Commented Sep 18, 2018 at 11:34


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.