3

Our main site www.example.com has a regular VeriSign SSL certificate. However, we need ssl for our dev environment for accurate testing. Is it possible to use another ssl from a different (cheaper) provider for our dev.example.com and stage.example.com domains? We have a load balancer with different ip's so having unique IP's should not be an issue.

2
  • You want to host prod, dev and staging on the same machine? o_O Apr 3, 2012 at 23:03
  • well no, they are on separate machines, but we have our analytics.example.com and other similarly named applications on the same machine.
    – SirrDon
    Apr 3, 2012 at 23:08

2 Answers 2

5

Yes

It is most certainly possible. I've worked with a few companies who buy expensive certificates (eg. Extended Validation certificates) for production sites, and cheaper certificates (Domain Validated certificates), sometimes from different Certificate Authorities, for development and testing purposes.

That being said, you might want to approach this a little differently though, especially when considering an "accurate testing" motive

First of all, SSL certificates primarily provide 3 things:

  1. Encryption
  2. Integrity
  3. Authenticity

The first feature, encryption, is provided no matter what CA you choose. A 2048-bit CSR signed by DigiSign provides just as strong encryption as a 2048-bit CSR signed by VeriSign.

The second feature, integrity, lies in the nature of the connection, that is: an encrypted message exchange between a client and a trusted server. So without the confidence in the Encryption and Authenticity, integrity of the message exchange cannot be achieved. Furthermore a message digest is calculated to ensure that the message is the same before encryption and after decryption

The third feature, authenticity, is determined by the trust relationship between the CA that issued your SSL certificate (eg. VeriSign), and the user (the client). This is important, because client software might trust one CA but not another. An example might be: testing a secure web application on a mobile device. The mobile device trusts the CA that issued your "test"-certificate, but as soon as you go into production everything breaks, because the CA that issued your production certificate is not trusted by the mobile device.

A possible solution (and one that I would often recommend), is the use of wildcard certificates, a certificate that matches a wildcard subdomain component, like: *.example.com. This way you can secure www.example.com, analytics.example.com, dev.analytics.com etc., all with the same certificate.

Wildcard certificates are pretty expensive, but if you have a handful of sites or more, it might be worth your while

3
  • 1
    Great notes! Don't overlook self-signed certificates in IIS7 as the cheapest means of adding SSLs to development & staging sites for testing! Apr 3, 2012 at 23:41
  • @ChrisAnton if the technical part (encryption), is the only worry, then yeah, self-signed certificates is without doubt the cheapest option :-) Apr 3, 2012 at 23:46
  • @ChrisAnton: You can get free Class 1 SSL certificates at StartSLL, and they are recognised by all major browsers.
    – paradroid
    Apr 3, 2012 at 23:55
1

It will depend on your LB config and your webserver choice and config but yes it should be possible to have different certificates on each subdomain.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .