Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a product (hosted PHP app) which we will be providing SSL certs to for people along with some hosting.

We are in full control of the hosting environment setting up the users vhost config, document root etc etc.

We are looking at multidomain certificates, which would allow us to bundle many of the domains into one certificate, this would end up saving the users quite a bit of money.

From what I understand though, when adding/removing a domain from a certificate the old one would need to be revoked and new one created - is that correct?

Any place other their have some sort of API for that?

This place here seems to mention their's is good for shared hosted along with dealing with single ips. Anyone had any experience?

http://www.comodo.com/business-security/digital-certificates/multi-domain-ssl.php

share|improve this question
1  
Keep in mind that Comodo has had some serious security problems recently. I would steer clear of these guys. A cracker was able to convince Comodo.com to provide bogus SSL certificates for google.com, yahoo.com, etc. (Potentially a huge problem), and they had a recent security breach. A quick Google search highlight's some of the recent problems: google.com/search?q=comodo+security+breach –  Stefan Lasiewski May 29 '11 at 2:04
add comment

1 Answer 1

up vote 1 down vote accepted

I would not recommend going with a multi-domain cert (let alone buying them from Comodo based on their reseller's recent security history) because of the revocation and reissuing you would need to do whenever you signed on a new hosted customer. If you had 50 customers and signed on a new one, you would not want to impact those 50 customers simply because you were adding a new one nor would your systems administration staff want to modify 50+ site configs each time you signed up (or lost) a customer.

I think you'd be far better served by structuring your sites so that customer name is in the host portion of your domain. For example, customer1.yourdomainname.com, customer2.yourdomainname.com, etc.

You might want to consider a managed pki solution from one of the CAs because you have a lot more control over certificate management and maintenance.

If you do not want to invest in the managed pki route, perhaps a wildcard certificate would better serve. Certificate maintenance still gets removed from the customer provisioning process (unless your private key for your wildcard cert gets compromised, of course).

That being said, I am not sure if any of the CAs have an API but OpenSSL, NSS, GNU-TLS, and JSSE are APIs so a good portion of your certificate provisioning process could still be scripted and/or automated

share|improve this answer
    
We are going to change the structure of the sites, it wasn't something we wanted to do which is why I asked the question, but it seems the sensible choice. Thanks. –  Wizzard Jun 1 '11 at 11:06
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.