I have 3 web-applications (
admin) that I want to protect with SSL and need a certificate. I'm not sure what certificate I need so I'll try to describe what I have, hoping that someone here will be able to assist.
- All are HTTP applications, some (
api) are JSON based API and some (
admin) are regular HTML based applications.
- All are currently deployed in Heroku. This might change in the future (in case it matters)
- All are deployed "twice" - prod/stage. Meaning - I have the following domains in DNS:
- I want to force HTTPS to all applications (done on the web server)
- Except of the company name domain, we also owe the brand names domains and I want to make them aliases (at DNS level). So the same application (with HTTPS) should be available from
I know that for all stage applications I basically can use a self-signed certificate. If I already need a multiple domain certificate, is there any reason not to use it for the stage as well?
Is SAN certificates what I need here? I've seen Digicert Unified Communications that allows 25 domains in one certificate (which is more than enough for me). Is that the kind of certificate I need for a web server? (they only mention communications products like exchange in their page).
If I buy a SAN certificate - How does the registration works? Do I "choose" one of the domains to be the "primary" FQDN and the others are only alternatives to it? If the user goes to brand1.com, does he know that it's an alternative domain?
And some other (somehow related) question - I need business validation for the certificate. The company name's domain is registered in whois by the company itself and we have the official papers so I guess there won't be a problem there. The brands names domains are also registered by the company (in whois), but we haven't registered them as trademarks or something. Does that make any problem? How do DigiCert match the brand to the company in this cases?