EEAA's answer is correct so I won't repeat that, but there's plenty to add on the subject of SSL/TLS.
A certificate for
example.com won't necessarily match
www.example.com as these are different domains. Most providers will automatically include the
www subdomain as a Subject Alternative Name when generating your certificate, (even the completely free CAs such as StartCom do this) but you should make sure that they actually do this before you ask them to generate the certificate.
You can buy a SAN certificate (also known as UCC or Unified Communications Certificate) that will allow you to have more than just the single subdomain in the same certificate, so you can buy one certificate to match
login.example.com. You can even have other domains included in a SAN certificate, so the same certificate can cover
example.co.uk (and the subdomains for all of those, although having more domains usually will cost you more).
Alternatively, you can buy a wildcard SSL certificate that covers every subdomain for a single domain.
Whether you are getting a single domain certificate, a SAN certificate or a wildcard certificate, there are three types of validation you can go through:
- Domain validated certificates are the quickest and cheapest type. The CA will verify that you control the domain you want the certificate for, typically by sending an email to one of the standard email addresses (such as
email@example.com) at that domain and verifying that you received it. These are fine if your website is your primary point of authority. Google uses domain-validated certificates.
- Organisation-validated certificates will take longer to process and cost more as they need to verify that the domain in question matches a physical address that is owned by the organisation whose name is on the certificate. This can often be accomplished with an automated phone call and can still be fairly quick.
- Extended validation (or EV) certificates take this several steps further and aim to establish the legal identity and appropriate authority to obtain the SSL certificate. These are the certificates that turn your browser URL bar green. Needless to say, they cost quite a bit more. Wildcards are not available in EV certificates.
The encryption used is the same in all of these certificates. The level of security provided is dependent on the key size you choose (you should choose 2048), the ciphers and versions of the SSL protocol your web server supports (this can be changed in your configuration). The main trick here is to not support the older, weaker ciphers and versions.
When it's time to go shopping, SSLShopper is the place to do it.