up vote 2 down vote favorite
share [g+] share [fb]

We have about 10 sites that we need to use https on and all the names look like this:

  • site1.domain.com
  • sitename.domain.com
  • site2name.domain.com

The domain is always the same but the subdomain is what changes. We don't own the domain but all of our sites are hosted on the same server and DNS is setup to cname our server and whenever we are going to host a new site the institution will cname our server again.

The question is, can we get a wildcard cert that will handle all the sites we have and it not interfere with some other sites that someone else has? Also, can a cert be installed on more than one server? What if we split up some of the sites and put a few on one server and a few on another?

link|improve this question
100% accept rate
feedback

2 Answers

up vote 4 down vote accepted

can we get a wildcard cert that will handle all the sites we have and it not interfere with some other sites that someone else has

Yes. A wildcard certificate that is installed on your servers and bound to your sites will not interfere with anyone elses subdomains, however anyone else could actually do the same thing (get their own wildcard for that domain) and imitate your site without anyone knowing.

can a cert be installed on more than one server

Yes, but you will need to transfer your Private Key to all the other servers as well. How to do this depends on your OS and web server of choice.

What if we split up some of the sites and put a few on one server and a few on another?

That will work fine

The one question you haven't asked that I will answer for you though, is can you even GET this certificate. Sure, if you can get it, it will work, but when you purchase SSL certificates, the most simplest form of validation is them sending an email to a fixed email address on the domain (e.g. admin@example.com) - they will give you a selection of email addresses to choose from, but if you don't own the parent domain you will at least require their co-opreating to get your copy of the certificate.

I have a suspicion you might be using a service like freedns.afraid.org. Getting a wildcard certificate when using a service like that could prove logisitcally difficult.

link|improve this answer
2  
I don't think you can get a certificate for a domain you don't own. The cheapest cert from Godaddy requires that you prove you have some level of control of the domain you are getting a wildcard for. – Zoredache Jan 26 '11 at 21:58
@Zoredache - I know you can get certificates if you have control over the subdomain (you just set up an MX record on the subdomain and specify that as the acceptable subdomain, e.g. admin@sub.example.com) - but I don't believe this is possible with wildcards as they technically don't have a subdomain, so I assume the parent domain is used (wouldn't actually know for sure, never bought a wildcard certificate) – Mark Henderson♦ Jan 26 '11 at 22:36
You shouldn't be able to get a certificate for a domain you don't own. You probably can. – mattdm Jan 27 '11 at 3:18
@mattdm I can generate a self-signed cert for whatever I want, but that doesn't mean it's going to be trusted by your browser... – JakeRobinson Jan 27 '11 at 15:47
That's not what I mean. – mattdm Jan 27 '11 at 16:39
feedback
up vote 2 down vote

If you want a trusted cert the domain must belong to your organization. It wouldn't "interfere" with some other site, but it's a security issue for everyone else on that domain. I don't think any reputable provider will allow you a wildcard cert for a domain without a valid WHOIS, or at least something on company letterhead that says that you own the domain.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.