Is SSL set on a per machine or per connection basis

Question

Is it possible to have a FTP server using SSL on a application server that does not use SSL?

How would you setup an ASP.NET 2.0 to consume a SSL certificate?

This certianly sounds possible but is it advisable, is it good practice?

Answer 1

While protecting an application with SSL is always a good idea, it is technically not trivial.

Having a web application protected with SSL requires the webserver to be reachable on a new port (443/https instead of 80/http). This has to be configured "system-wide". Also, there may be only one certificate per IP-address, which is often a problem when hosting multiple domains on the same server.

Answer 2

FTP is at the application layer, and SSL is lower, at the presentation layer. The SSL sessions are on a per connection basis. Take a look at the Wikipedia page. The SSL connection is established before anything happens with your application. Your FTP server probably isn't running inside your .NET application server, is it? You should be able to setup an SSH server listening for SCP connections separately. If it really does run from inside your app server, you should be able to listen on a separate port for the SSL connection.

Short of any of that, heres a good link for configuring SSL in IIS. You don't have to make the certificates mandatory. That way you can allow unsecured traffic and secure traffic if that fits in with your application model.

Answer 3

The choice on using SSL us made on a per connection level, usually determined by the IP port being used (i.e. will be set up between client and server before any application code involved).

The same service/content could be set up on multiple ports each with a different choice for SSL.

The certificate is per host name, but servers can generally support appearing under different names.

To use SSL with ASP.NET takes nothing special, it just works once the IIS web site is configured to support SSL (or to require it: when connections to port 80 for HTTP are redirected to the SSL port); this choice can be made on a per folder basis.