Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

If I have test.example.com and prod.example.com (two hostnames, but same domain name) can I use the same SSL cert on both machines?

In the past when I tried using a prod.example.com cert on test.example.com it resulted in browser warnings for host-mismatch, which led me to believe that I needed a wildcard (or else multiple distinct certs). (Perhaps my mistake was in generating the CSR for prod.example.com rather than simply example.com ?)

But the various SSL vendors' websites mention needing a wildcard cert for subdomains, which is not at all what I am using.

Is their language simply incorrect? (My cynical side wonders if this helps vendors sell more expensive certs...)

share|improve this question
    
Why do you think you're not using subdomains? test.example.com and prod.example.com are subdomains of example.com. –  Mike Scott Dec 20 '11 at 5:45
    
Mike Scott: my understanding is that a subdomain would be x.y.example.com, but perhaps I am mistaken. vogtland.ws/MarksBlog/?p=280 –  Caffeine Coma Dec 20 '11 at 13:06
    
@CaffeineComa His point was that prod.example.com and test.example.com are subdomains of example.com. If you were to get a wildcard for example.com it would cover both prod.example.com and test.example.com as well as any other subdomains of example.com (and example.com itself). –  MDMarra Dec 20 '11 at 13:37
    
x.y.example.com is a subdomain of y.example.com. y.example.com is a subdomain of example.com. Technically, example.com is a subdomain of com. –  Mike Scott Dec 20 '11 at 15:37
    
Got it, thanks. –  Caffeine Coma Dec 21 '11 at 4:24

3 Answers 3

up vote 8 down vote accepted

You would need a certificate that supports the Subject Alternate Name field and you would have test.example.com in there for it to work in the example that you described.

A cert for example.com will not magically work for *.example.com like you are describing unless it is a wildcard cert, which you explicitly say that you do not have. The SAN field listing each sub-domain is what you need if you're not going to get a wildcard.

share|improve this answer

Is their language simply incorrect?

No, yours is.

If I have test.example.com and prod.example.com (two hostnames, but same domain name)

These are not the same domain name. They are both separate domain names that happen to be subdomains of example.com.

A domain name is any name that exists at any level in the DNS, not just the ones you get from your domain registrar.

An SSL certificate can only cover:

  1. An exact domain name
  2. As above, but with additional "Subject Alternate Names", or
  3. every sub-domain, i.e a wildcard cert.

Hence you can't just get a cert for example.com and have it automatically cover the subdomains too.

share|improve this answer

First a clarification: there are no subdomains in the way you are using - only domains. Or better you can say that any domain that you will own is a subdomain. The root domain is ".". The TLD "com." is a "subdomain" of ".". "example.com." is a subdomain of "com."... A subdomain is a domain defined inside another domain. but this is relative, not an absolute attribute.

The wild card certificates are more expansive not because they are different from a domain one, but because of their exposure and chances to get compromised. You are not paying the SSL CA the "price" for certificate, but an limited insurance. This insurance covers only if the breach is caused by a mishandling of your certificate and it's chain by the CA.

If you have only a few subdomains it is cheaper to buy a certificate for multiple domains (certificates that use Subject Alternate Name). If you have many subdomains of a domain or you expect to add an unknown number of subdomains you should better buy a wildcard certificate. If you have different domains (example1.com, example2.com, example1.us) you can use only SAN certificates or you buy a wildcard certificate for each domain. (E.g. you can not buy a wildcard certificate for *.com).

Using SAN certificate or wildcard certificate could lower the security of your configuration, because will force you to use the same listener and most probably use the same user (you can run with different users with something like mod_suexec for apache). So if one site gets compromised, could lead for the other sites to get compromised. If you have different certificates you can run those applications as different users and have better security.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.