Deploying Sitecore 9 in distributed environments

1. SOLR and xConnect need to be public – no, those are not intended to be public so long as they can access all the sitecore sites and the DBs on the internal network
2. You mentioned your current CM is both reporting and CMS. This can stay this way in Sitecore 9 as well
3. When deploying to production do you migrate the same certificates for SOLR and xConnect or do you need new ones – yes, you can use the same ones that you use on lower environments unless you specifically prefer new ones.
4. Do you need something around notifications when SOLR is down and what could be used – yes, you can use tools to monitor the production solr urls to see if it's up and running and to auto send out emails if it's not. For MS, XCentium uses Azure alerts, sumologic, statuscake and datadog or a combination of those four things. And pingdom as well.

1. Regarding Installation on all the environment, Should we use SIF framework and install Sitecore site, Solr, xconnect and DB? Our DBA does not allow creating Databases remotely. If we have to run the SIF from sitecore server, can we export the DB backup to upper environment and just install Sitecore, Solr, xconnect on the respective server? What we would like to understand is the plan to install unto Prod environment.
2. Certificates for Solr and xconnect – Should we buy separate certificates from vendors? We do have certificates for Sitecore site.

1. It would be better if you installed everything locally and then migrate the DBs. Does that answer your question Nalan?
2. You don’t have to buy certificates for xConnect and SOLR, you can use self-signed or if you run your own CA server you can use your own certificates. Or if you have ‘wildcard’ certificate you can use that too. I know Azure for example doesn’t allow self-signed but I am not sure about AWS. I think it does. So if AWS requires a purchased certificate then yes, you needed. But if it doesn’t – then you don’t. Does that make sense?