Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have 3 web-applications (api, app and admin) that I want to protect with SSL and need a certificate. I'm not sure what certificate I need so I'll try to describe what I have, hoping that someone here will be able to assist.

Few details:

  • All are HTTP applications, some (api) are JSON based API and some (app and admin) are regular HTML based applications.
  • All are currently deployed in Heroku. This might change in the future (in case it matters)
  • All are deployed "twice" - prod/stage. Meaning - I have the following domains in DNS: app.domain.com, api.domain.com, admin.domain.com, app.stage.domain.com, api.stage.doamin.com, admin.stage.domain.com
  • I want to force HTTPS to all applications (done on the web server)
  • Except of the company name domain, we also owe the brand names domains and I want to make them aliases (at DNS level). So the same application (with HTTPS) should be available from app.domain.com and app.brand1.com

I know that for all stage applications I basically can use a self-signed certificate. If I already need a multiple domain certificate, is there any reason not to use it for the stage as well?

Is SAN certificates what I need here? I've seen Digicert Unified Communications that allows 25 domains in one certificate (which is more than enough for me). Is that the kind of certificate I need for a web server? (they only mention communications products like exchange in their page).

If I buy a SAN certificate - How does the registration works? Do I "choose" one of the domains to be the "primary" FQDN and the others are only alternatives to it? If the user goes to brand1.com, does he know that it's an alternative domain?

And some other (somehow related) question - I need business validation for the certificate. The company name's domain is registered in whois by the company itself and we have the official papers so I guess there won't be a problem there. The brands names domains are also registered by the company (in whois), but we haven't registered them as trademarks or something. Does that make any problem? How do DigiCert match the brand to the company in this cases?

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

It sounds like SANs certs will work fine in your case. A few of things must be mentionned, though:

  • If you want to use alias DNS name for your second-level domain name, then you will need to get new SANs certs for these aliases.
  • Consequence of the above, you will need to use different IP addresses for the aliases (even though they can all be linked to the same source).
  • When you use shared hosting, different hosting providers have different procedures for handling certificates. Some are very flexible and let you use whatever certificate you care to provide (as long as you also provide the relevant private key, of course) some will force you to go through their procedure which makes retrieving the private key if you want to move later pretty hard (or impossible).
  • When you register a new SAN, you typically pick the "base" name and then add any and all necessary aliases. It doesn't really matters what the base name is because SAN-compatible client will ignore the Subject.CommonName field and use the SAN only.
  • End user will receive the X509 certificate with the connection and can examine it. If they do, they will see all the SANs in that certificate.
share|improve this answer
    
thanks! Do you mean that I'll need another certificate to brand1.com and brand2.com or I'll just have to add them as SANs to the certificate for doamin.com? Buying 3 certificates is starting to get expensive.. I hoped to avoid it by buying a SAN one –  Zach Moshe May 1 '13 at 7:58
    
You'll need different certificates for brand1.com and brand2.com (and different IP addresses as well) –  Stephane May 1 '13 at 8:10
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.