1

How many certificates need to be bought for XP Scaled (XP1) Sitecore 9.1 distributed (on premises) architecture .

When i install in distributed architecture in single server, i see each process having created its own certificate. 12 process 12 certificate.

My query is when we moved production do we need have certificate for each process below

  • xxx.sitecore.CM,
  • xxx.sitecore.identityserver
  • xxx.sitecore.CD
  • xx.sitecore.collection
  • xxx.sitecore.ma
  • xxx.sitecore.reporting
  • xxx.sitecore.processingEngine
  • xxx.sitecore.refdata
  • xxx.sitecore.reporting
  • xxx.sitecore.search
  • xxx.sitecore.rep
  • xxx.sitecore.prc

i could see in document server certificate to be required for following

  • Sitecore Identity server
  • Processing
  • Reporting
  • xConnect Collection
  • xConnect Collection Search
  • xDB Reference Data -xDB Automation Operations
  • xDB Automation Reporting
  • Sitecore Cortex™ Reporting Service
  • xDB Automation Operations and SOLR

Can any one please confirm?

|improve this question

closed as primarily opinion-based by Amitabh Vyas, Patrick Barron, Pete Navarra, Gobinath Saminathan, Dylan Young Apr 17 at 18:53

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • I am voting to close this question as it will be primarily opinion based. It all depends on how you want to issue certificates, do you allows wild card certificates etc. You can have dedicated Server Certs for each IIS Role and obviously independent Client certificates. Or you can have one Server Cert for all Roles (by adding Subject Alternative Names) and obviously independent Client certificates. – Amitabh Vyas Apr 16 at 19:02
  • I think there could be a best practice way of doing this though no? @AmitabhVyas – Anicho Apr 17 at 8:54
  • @AmitabhVyas In local, we generally generate the self signed certificate and assigning it to xconnect role, but in the PROD case, how to get the client certificate so that connectivity between CM an CD can happen? – Amit Kumar Apr 17 at 10:36
  • @Anicho I would say the approach will differ from client to client. Every organization have their own standards of issue certificates hence we have to adhere to those standards. Talking about best practices wrt Sitecore, I prefer defining/combining the roles first and then discussing with security/networking team about the way they would like to issues the certificates. – Amitabh Vyas Apr 17 at 13:49
  • @AmitKumar that is correct. I suggest Self signed certificates a big NO for any upper environment then Dev. Hence once you define/combine the xConnect roles, issue a client certificate per role with a thumbprint. Now the client certificates need to be installed on the Clients who are calling the services (CM/CD/PRC/REP), thumbprint need to be provided in connection strings on non-xConnect roles and appsetting.config to the corresponding xConnect role. – Amitabh Vyas Apr 17 at 13:59