Borresen, John - 0442 - MITLL wrote: Personally I' prefer to issue separate certs to each replica. I use the server certs also as client cert for authenticating the replicas to each other with SASL/EXTERNAL. Ciao, Michael.

On Tue, Jan 14, 2014 at 03:09:43PM -0500, Borresen, John - 0442 - MITLL wrote: Do you mean that you'll be accessing these hosts using non-fully qualified hostnames? (e.g. 'server1.llan.ll' or 'server1' ?) If so, you can put these names in the SAN list. You can put IPs in there, too, but MS wants special treatment for that... Really, though, as you're doing this all privately, you need to consider: - How often would the membership of your cluster change (adding/removing hosts)? - How are you distributing the trust of the signer? One CA means your clients only need to be told once about the signer, and self-signed means your clients needs to be told about each cert. (Well, each signer, but sounds like it's implicitly fluid, given the prior question.) If - cluster membership will change - you don't want to touch each client when that happens - you're using non-fully qualified hostnames The I think you'll benefit from a CA, rather than self-signed certificates. That doesn't address wildcard vs a SAN list. Can you forecast that the current and future hostnames for your cluster will always be expressible as a wildcard? If not, consider a SAN list. -- Brian Reichert <reichert(a)numachi.com&gt; BSD admin/developer at large