Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What is the best practice to use SSL certs for subdomains?

The goal is to generate one certificate for the domain and then use it for subdomain

Is it correct practice or it's best to generate separate certs for and


share|improve this question
up vote 7 down vote accepted

Unless you have bought a certificate which has the subdomain as a Subject ALT Name value then yes, otherwise you need a wildcard certificate.

Basic ssl certs for generally will not support

Best practice is probably more a matter of taste, for sake of easy management, it's probably easier to have a wildcard cert or multi-domain certificate. However if one of the domains or machines running the cert gets compromised and you need to revoke the certificate, you have to revoke the whole certificate, not just a single domain. So if this is for a lot of machines this is perhaps not recommended.

Ultimate security of certificates would come down to having different private keys and seperate individual certificates, but for lots of sites this could become a management issue.

share|improve this answer
Thanks @anthonysomerset. Is the wildcard certificate the one which has Common Name = * I am actually creating certs with openssl now. – Vladimir Sep 18 '11 at 17:44
correct wildcard is * – anthonysomerset Sep 19 '11 at 6:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.