Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What is the best practice to use SSL certs for subdomains?

The goal is to generate one certificate for the domain y.com and then use it for subdomain x.y.com?

Is it correct practice or it's best to generate separate certs for y.com and x.y.com?

Thanks!

share|improve this question

1 Answer 1

up vote 6 down vote accepted

Unless you have bought a certificate which has the subdomain as a Subject ALT Name value then yes, otherwise you need a wildcard certificate.

Basic ssl certs for domain.com generally will not support sub.domain.com.

Best practice is probably more a matter of taste, for sake of easy management, it's probably easier to have a wildcard cert or multi-domain certificate. However if one of the domains or machines running the cert gets compromised and you need to revoke the certificate, you have to revoke the whole certificate, not just a single domain. So if this is for a lot of machines this is perhaps not recommended.

Ultimate security of certificates would come down to having different private keys and seperate individual certificates, but for lots of sites this could become a management issue.

share|improve this answer
    
Thanks @anthonysomerset. Is the wildcard certificate the one which has Common Name = *.y.com? I am actually creating certs with openssl now. –  Vladimir Sep 18 '11 at 17:44
    
correct wildcard is *.domain.com –  anthonysomerset Sep 19 '11 at 6:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.