管理多租户网站的 SSL 证书
我们有一个多租户网站，我们使用通配符 SSL 证书为人们提供我们网站的子域。我们的一些客户希望使用自己的域，但我担心随着业务的增长，我们将如何管理每个客户的证书。目前，证书驻留在 Web 服务器上，这意味着在我们添加证书时将所有证书加载到每个 Web 服务器。
我知道我们可以在 Web 服务器前面引入专用的 SSL 设备，但是还有其他选项可以改进这些证书的管理吗？
We have a multi-tenant website where we use a wildcard SSL cert to give people a subdomain to our site. Some of our customers would like to use their own domain, but I'm concerned about how we would manage each customer's certificate as our business grows. Currently the certificate resides on the web server, which means loading all of the certs to each web server as we add them.
I'm aware we could introduce a dedicated SSL device in front of the web servers, but are there other options to improve the management of these certificates?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我是一名 Microsoft 技术布道者，我的一位合作伙伴也面临着完全相同的挑战。
我创建了一个示例源代码，它使用名为 SNI（一种 SSL 主机头）的新 IIS 8 (Windows Server 2012) 功能来自动化和管理多个域绑定的 SSL 证书。
您需要做的就是重用我的代码（这非常简单）并将自定义 SSL 证书上传到 blob 存储，或者您可以编写自己的提供程序以从数据库获取自定义域和证书。
我已经在以下位置发布了详细的解释和示例“即插即用”源代码：
http://www. vic.ms/microsoft/windows-azure/multiples-ssl-certificates-on-windows-azure-cloud-services/
I'm a Microsoft Technical Evangelist and one of my partners had exactly the same challenge.
I have created a sample source code that automates and manages SSL certificates for multiple domain bindings using a new IIS 8 (Windows Server 2012) feature called SNI, which is a kind of SSL hostheaders.
All you will need to do is to reuse my code (it's quite simple) and upload your custom SSL certificates to the blob storage, or you can write your own provider to fetch custom domains and certificates from your database.
I have posted a detailed explanation and a sample "plug & play" source-code at:
http://www.vic.ms/microsoft/windows-azure/multiples-ssl-certificates-on-windows-azure-cloud-services/
您可以让您的客户处理他们自己的证书并让他们运行自己的 https 站点。他们可以提供包含您的内容的单个框架的页面（通过 https）。用户将看到他们的域和证书，只要框架内容也通过有效的 https 连接加载，浏览器就会加载框架而不会抱怨。我创建了一个快速的脏测试页面，以便您可以看到它的运行情况。
此解决方案将“破坏”地址栏，因为它将保留包含框架的页面的 URL。根据您运行的网站的类型，这可能会成为一个阻碍。
You could make your clients deal with their own certificates and make them run there own https site. They can serve a page containing a single frame with your content (over https). The users will see their domain and their certificate and the browser will load the frame without complaining as long as the frame contents are also loaded over a valid https connection. I created a quick an dirty test page so you can see it in action.
This solution will 'break' the address bar as it will keep the url of the page containing the frame. Depending on the type of site you're running this might be a showstopper.