Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 3 down vote favorite

Let say I have an ASP.NEt application which is bound with more than 10 domains using host headers. Is one certificate is enough for me? or I need more than 1 certificate for each domain? If I need 1 certificate, then adding a new domain means reinstall the certificate?

share|improve this question

3 Answers

up vote 9 down vote accepted

There are multiple certificate types.

  • You can have a wildcard cert *.domain.com which is valid for all subdomains.
  • You can have a single-name cert host.domain.com which is only valid for this host
  • You can have a multi-name cert host1.domain1.com, host2.domain2.com, this is called a SAN (Subject Alternative Name) Certficiate. They are often called "UC-Certificate" by cert vendors.

I'm not sure where the technical limit is on a SAN cert, but it's certainly more than 10 names.

share|improve this answer
Just see the below comment. – user960567 May 22 '12 at 7:05
On many cert vendors, you can add and remove SAN entries anytime, and re-issue the cert. This is however vendor specific. – MichelZ May 22 '12 at 7:08
Is I need to reinstall the certificate? I mean I need to configure my server every time when I add a new domain. – user960567 May 22 '12 at 7:09
Yes, with a SAN Certificate you have to. The only time where you don't have to would be a wildcard cert. Or maybe the SAN cert allows to use Wildcard, to cover multiple domains, not sure (i.e. *.domain1.com & *.domain2.com – MichelZ May 22 '12 at 7:11
Thanks very much man. – user960567 May 22 '12 at 7:13
up vote 6 down vote

If they are truely unique domain names, you can get a SAN (Subject Alternative Name) certificate. Most vendors will let you put about 40 domain names on one cert. If they are sub-domains, a wildcard cert is the way to go. For each of tjose options you only need 1 ip as the cert is valid for all listed domain names.

share|improve this answer
What if I needed to add a new domain in SAN? Is I need to reinstall this domain to server? Whether domain be added dynamically? – user960567 May 22 '12 at 7:05
You will need to have the issuer re-issue the cert with the new name in addition to the ones already set up. Most vendors allow you to do this via a web portal. Then you'll need to re-install the cert – Zypher♦ May 22 '12 at 7:08
Is I need to configure the server when I add a new domain in SAN certificate? – user960567 May 22 '12 at 7:10
up vote -2 down vote

Each SSL certificate is valid of one FQDN (or one domain if you use a wildcard certificate), and one IP address. That means that for 10 domains you will need 10 different certificates at least, as well as 10 different IP addresses, since you can't have more than one certificate on a particular IP address.

share|improve this answer
4  
This is very outdated information, we have SAN certs and wildcard certs to cover these situations now. – Zypher♦ May 22 '12 at 7:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.