0

I have a WordPress + WooCommerce online store which is hosted on a managed hosting. I just bought non-wildcard SSL Certificate for that online store.

I am also developing a CherryPy Python Web App which must must use HTTPS for communication with WooCommerce API in order to update the inventory of the online store.

Here is where I am confused:

If my CherryPy Web App is deployed on Virtual Private Server (not where my online store is hosted) which SSL certificate can/should I use :

  • The one that I just bought
  • I should use Self-Signed SSL certificate
  • Deploy the app where my website + certificate are
  • Deploy my website on the VPS server where my Web App is

Maybe I am not in the right direction at all?

1 Answer 1

0

If the hostname is identical—i.e. if the certificate you just purchased was for example.com and you are setting up your CherryPy app on example.com/store, then you're good to go. Do not self-sign since the issuing CA you just purchased from went out of their way not to endorse any hostnames other than the one that you paid for (omitting subdomains). If you plan to set it up elsewhere, e.g. store.example.com, you will need to buy a new certificate for the subdomain. You can use the same certificate on as many machines as you wish (most likely) as long as they are being accessed via the one endorsed hostname. I think your best course of action is to either migrate the website over to your web app VPS like you said, then setup a secondary VPS that is dedicated to routing and signingor use a self-signed certificate for use between the shared host and your main entry point—or use a self-signed certificate for use between the shared host and your main entry point (VPS) only, and in that case a root CA's endorsement is of no consequence because you know you can trust you.

Client ~~ GET https://ex.com/store ~~~> VPS                                 Shared Host
Client                                  VPS ~~ GET https://store.ex.com ~~> Shared Host
Client                                  VPS <~ OK (self-signed cert) ~~~~~~ Shared Host
Client <~ OK (CA-signed cert) ~~~~~~~~~ VPS                                 Shared Host

Something like this, sort of a healthy MITM. If someone requests the web app on the VPS, then the VPS can just respond normally without involving the shared host.


As an aside, these seemingly arbitrary restrictions that you can only lift with a flick of your magic AmEx should not be an issue later on this year.

You must log in to answer this question.