Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My basic quandry is that wildcard certificates don't support subdomains of subdomains, nor do they help with alternate domain names. Basically, if my CN is, I want a Subject Alternative Name field that looks roughly like so: DNS* DNS:* DNS:* DNS:*

Using a self-signed cert, I verified that the browsers will work just fine with this.

Unfortunately, none of the Certificate Authorities that I looked into (Thawte, GoDaddy, Verisign, Digicert) seemed to support both wildcard certs and Subject Alternative Name (sometimes referred to as "Multiple Domain UCC"). I even called up GoDaddy tech support to confirm. Is there a CA (trusted by 99% of browsers) that supports wildcards for the Subject Alternative Name?

share|improve this question
I recommend you edit out the Amazon EC2 stuff and make it a new question. The two topics are not technical related (CA's and EC2 design). Then you'll likely get a better answer to your first question about CA's. – Bret Fisher Mar 10 '11 at 0:03
I know it's a month later, but you're right. I'm editing the question now to only be one question. Thanks. – nicholas a. evans Apr 5 '11 at 14:38
up vote 3 down vote accepted

Digicert Premium Wildcards support up to 10 (I think) SANs per duplicate. I'm sure others do as well.

share|improve this answer
According to their site: they'll do it as long as the SANs are subdomains of the issued domain. They also claim this is unique amongst all wildcard cert sellers (though Comodo PremiumSSL automatically added as a SAN for my * cert), so it may be the best he can do. He might contact them and offer to pay for two wildcard domains if they'll combine it into one cert. – DerfK Mar 10 '11 at 0:23
Thanks @MarkM and @DerfK. We did wind up talking to all of the major certificate authorities, and none of them officially supported this option. However, Digicert was uniquely willing to work with us to get this to work anyway. First we bought separate certificates for all of the domains we needed like normal, and then Digicert manually combined them all into one single cert (using Subject Alternative Names). Maybe if enough people request this, it can become a standard product. – nicholas a. evans Apr 5 '11 at 14:47
That's awesome @nicholas! Thanks so much for this info! – cregox May 8 '11 at 2:16
By the way, we've just got a 10 SAN within one domain using and added 2 alternative names like,, and it worked perfectly fine! It's called "Standard UCC SSL", at least with Godaddy. So, not sure if they catch up in 1 month or if they (most likely) always had this, but looks like you have missed something on your research, mr @evans! ;) – cregox May 8 '11 at 3:46
Thanks for the note @nicholasa.evans. We ended up going with Digicert because they were able to manually combine them (as you mentioned). – Adam Spicer Oct 3 '12 at 18:42

I know this is an old question. But you can do this with StartCom as well, as long as you have done at least level 2 validation.

share|improve this answer

Comodo also offers a Multidomain wildcard certificate in their InstantSSL range. Three domains are included.

That isn't the cheapest price, Google for a Comodo reseller and you'll find it for a LOT less.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.