Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've only done basic stuff with signed certificates (basically follow the instructions from CA).

I have general questions moving forward that I hope someone can answer. There are so many different kinds of certificates available and even more price points. I'm looking for an economical way to bring SSL to a number of services hosted on one physical server.

Server has a domain name: servername.mydomain.com

Server also responds to aliases: www.mydomain.com, .mail.mydomain.com, mydomain.com

Server also responds to virtual domains: www.virtual1.com, mail.virtual1.com, www.virtual2.com

From what I understand basic SSL from someone like RapidSSL will just cover the primary servername.mydomain.com. What happens, then, if someone hits the virtual domain? or an alias? Do we need to get certificates for those domains as well?

What's an economical way to cover all scenarios above?

What about just covering all aliases w/in the primary domain?

share|improve this question

1 Answer 1

What you're looking for are either SAN (aka UCC), Wilcard Certs, or SNI.

  • SAN = Subject Alternate Name. Certs are issued to Subject, which are most commonly Common Names (CN) like "www.example.com". Certificates can have Alternate names in them.
    • The problem is that you have to name each of them. Like "a1.example.com", "a2.example.com", "b1.example.com".
    • The benefit is that most providers offer this solution quite cheap and almost all SSL enabled software supports them well.
  • Wildcard certs are what they sound like, to a degree. You can get a wildcard certificate for "*.example.com" and it will cover "anything.example.com" to "zebra.example.com".
    • The benefit is that you can use one certificate for unlimited subdomains of a single domain.
    • There's two major drawback. One, you only get to have one wildcard, so it can only be for one domain. Two, the wildcard only applies to the level it appears in. So if you get a wildcard cert as described above it would not work for "level.two.example.com"
  • SNI = Server Name Indicator. It's a new technology that enables a webserver to use multiple certificates on the same address and port. Normally you can only use 1 certificate on a IP:Port tupple. If you want to use multiple certs you had to either use multiple IPs or multiple Ports (ports tends to not work well as you need to explicitly specify the port in the URL, and no common user would ever know to type in a Port number or even how).
    • The good: You can use any combination of the certificates mentioned already on the same server. This makes it fairly easy to host everything you mentioned in the Question.
    • The Bad: Fairly few server software support it, most of the major Web Servers do support it in their latest versions, but not all, and outside of web servers it's pretty rare.
    • The Worse: Almost no clients support SNI, except the latest generation of Internet Browsers. Unless you can specify to your clients that they must have an up to date web browser, and those clients will actually comply, this isn't an option for another 2-4 years.

What's right for you? You're probably going to be suck with a couple wildcard certs on various IPs right now. There really isn't much better option yet. On the upshot, some cert vendors offer some pretty cheap wildcard certs; I use http://startssl.com because they're dirt cheap and work.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.