Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am new to SSL certificates and their setup. I have not found any details regarding this so I am asking what may be simple question.

I am going to order an SSL certificate so I want to know if an SSL certificate with the specified common name also works for

share|improve this question
up vote 8 down vote accepted

Yes. The domain needs to match the CN specified in the cert. SSL certs have nothing to do with any of the rest of the URL.

share|improve this answer

EEAA's answer is correct so I won't repeat that, but there's plenty to add on the subject of SSL/TLS.

A certificate for won't necessarily match as these are different domains. Most providers will automatically include the www subdomain as a Subject Alternative Name when generating your certificate, (even the completely free CAs such as StartCom do this) but you should make sure that they actually do this before you ask them to generate the certificate.

You can buy a SAN certificate (also known as UCC or Unified Communications Certificate) that will allow you to have more than just the single subdomain in the same certificate, so you can buy one certificate to match,, and You can even have other domains included in a SAN certificate, so the same certificate can cover, and (and the subdomains for all of those, although having more domains usually will cost you more).

Alternatively, you can buy a wildcard SSL certificate that covers every subdomain for a single domain.

Whether you are getting a single domain certificate, a SAN certificate or a wildcard certificate, there are three types of validation you can go through:

  1. Domain validated certificates are the quickest and cheapest type. The CA will verify that you control the domain you want the certificate for, typically by sending an email to one of the standard email addresses (such as at that domain and verifying that you received it. These are fine if your website is your primary point of authority. Google uses domain-validated certificates.
  2. Organisation-validated certificates will take longer to process and cost more as they need to verify that the domain in question matches a physical address that is owned by the organisation whose name is on the certificate. This can often be accomplished with an automated phone call and can still be fairly quick.
  3. Extended validation (or EV) certificates take this several steps further and aim to establish the legal identity and appropriate authority to obtain the SSL certificate. These are the certificates that turn your browser URL bar green. Needless to say, they cost quite a bit more. Wildcards are not available in EV certificates.

The encryption used is the same in all of these certificates. The level of security provided is dependent on the key size you choose (you should choose 2048), the ciphers and versions of the SSL protocol your web server supports (this can be changed in your configuration). The main trick here is to not support the older, weaker ciphers and versions.

When it's time to go shopping, SSLShopper is the place to do it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.