Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I have and (two hostnames, but same domain name) can I use the same SSL cert on both machines?

In the past when I tried using a cert on it resulted in browser warnings for host-mismatch, which led me to believe that I needed a wildcard (or else multiple distinct certs). (Perhaps my mistake was in generating the CSR for rather than simply ?)

But the various SSL vendors' websites mention needing a wildcard cert for subdomains, which is not at all what I am using.

Is their language simply incorrect? (My cynical side wonders if this helps vendors sell more expensive certs...)

share|improve this question
Why do you think you're not using subdomains? and are subdomains of – Mike Scott Dec 20 '11 at 5:45
Mike Scott: my understanding is that a subdomain would be, but perhaps I am mistaken. – Caffeine Coma Dec 20 '11 at 13:06
@CaffeineComa His point was that and are subdomains of If you were to get a wildcard for it would cover both and as well as any other subdomains of (and itself). – MDMarra Dec 20 '11 at 13:37 is a subdomain of is a subdomain of Technically, is a subdomain of com. – Mike Scott Dec 20 '11 at 15:37
Got it, thanks. – Caffeine Coma Dec 21 '11 at 4:24
up vote 8 down vote accepted

You would need a certificate that supports the Subject Alternate Name field and you would have in there for it to work in the example that you described.

A cert for will not magically work for * like you are describing unless it is a wildcard cert, which you explicitly say that you do not have. The SAN field listing each sub-domain is what you need if you're not going to get a wildcard.

share|improve this answer

Is their language simply incorrect?

No, yours is.

If I have and (two hostnames, but same domain name)

These are not the same domain name. They are both separate domain names that happen to be subdomains of

A domain name is any name that exists at any level in the DNS, not just the ones you get from your domain registrar.

An SSL certificate can only cover:

  1. An exact domain name
  2. As above, but with additional "Subject Alternate Names", or
  3. every sub-domain, i.e a wildcard cert.

Hence you can't just get a cert for and have it automatically cover the subdomains too.

share|improve this answer

First a clarification: there are no subdomains in the way you are using - only domains. Or better you can say that any domain that you will own is a subdomain. The root domain is ".". The TLD "com." is a "subdomain" of ".". "" is a subdomain of "com."... A subdomain is a domain defined inside another domain. but this is relative, not an absolute attribute.

The wild card certificates are more expansive not because they are different from a domain one, but because of their exposure and chances to get compromised. You are not paying the SSL CA the "price" for certificate, but an limited insurance. This insurance covers only if the breach is caused by a mishandling of your certificate and it's chain by the CA.

If you have only a few subdomains it is cheaper to buy a certificate for multiple domains (certificates that use Subject Alternate Name). If you have many subdomains of a domain or you expect to add an unknown number of subdomains you should better buy a wildcard certificate. If you have different domains (,, you can use only SAN certificates or you buy a wildcard certificate for each domain. (E.g. you can not buy a wildcard certificate for *.com).

Using SAN certificate or wildcard certificate could lower the security of your configuration, because will force you to use the same listener and most probably use the same user (you can run with different users with something like mod_suexec for apache). So if one site gets compromised, could lead for the other sites to get compromised. If you have different certificates you can run those applications as different users and have better security.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.