Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've scoured the web for a clear and concise answer to my SSL question, but to no avail. So here goes:

I have a web-service requiring SSL support for authentication pages. The root-level domain does not have the "www" - i.e., secure://domain.com - but localized pages use "language-code.domain.com", i.e. secure://ja.domain.com

So I need at least a wildcard SSL certificate that supports secure://*.domain.com

However, we also have a public sandbox environment at sandbox.domain.com, which we also need to support under localized domains - so secure://ja.sandbox.domain.com needs to also work.

The previous admin managed to purchase a wildcard SSL certificate for .domain.com, but with a Subject Alternative Name for "domain.com". So, I'm thinking of trying to get a wildcard certificate with SANs defined as "domain.com" and ".*.domain.com".

But now I'm getting confused because there seem to be separate SAN certificates, also called UCC certificates.

Can someone clarify whether it's possible to get a wildcard certificate with additional SAN fields, and ultimately what the best way is to support:

secure://domain.com secure://.domain.com secure://.*.domain.com

with the fewest (and cheapest!) number of SSL certificates?


share|improve this question
What does 'SAN' expand to in this context? –  Jason Tan Apr 25 '10 at 15:21
Subject Alternative Name –  Warner Apr 25 '10 at 22:01

1 Answer 1

First, SAN certificate = UCC certificates. They are both just certificates with the SubjectAltName field.

Second, a wildcard of ..domain.com won't work in most browsers. You will either need to get two wildcard certificates (one for *.sandbox.domain.com and one for *.domain.com) or get a wildcard certificate for *.domain.com and have your SSL provider put a specific SubjectAltName of ja.sandbox.domain.com. I think DigiCert and GlobalSign offer this.

share|improve this answer
Thanks Robert - you're absolutely right. I ended up getting two certs - one for the sub-domain, another for the sub-sub domain. I should also note, it seems some SSL providers include the root domain in the SAN as a complement, while others do not (in which case you'd need to register another cert). GoDaddy for example includes "domain.com" in the SAN when buying wildcard cert *.domain.com, but RapidSSL does not. –  user41426 Apr 27 '10 at 5:18
At least since 2013, RapidSSL do include 'domain.com' in the wildcard certificates. –  Arto Bendiken Feb 20 '14 at 19:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.