Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I own,, and

I use Apache to rewrite and to

Based on this rewriting, it is my understanding that I would only need a certificate for, and not and Please confirm.

I am using sub-directories and not sub-domains to structure my site.

The one exception is the www sub-domain.

If I want SSL for both as well as, do I need either two certificates or a wildcard certificate?

Would you recommend rewriting one of these domains to the other, and just using a single certificate? If so, which one would you recommend using, and why?

share|improve this question
up vote 4 down vote accepted

If you want a certificate to handle and you should NOT use a wilcard certificate, because * does not match Instead you need a certificate which has like as the common name and then add to subject alternative names.

Also, if you want or redirect to you need to add both these host names (and maybe the responding www.example.* too) also to the subject alternative names, because the redirection occurs only after the TLS handshake and certificate verification. Otherwise the browser will complain about invalid certificates and the redirect will only be effective after the user overrode this warnings.

share|improve this answer
Many CAs including Godaddy will sell you a wildcard for *, that will have a subject alternative name that includes the literal for no additional cost. This works on most browsers from the last 5-10 years. So while it is true that *.domain.tld does not match domain.tld, this is a distinction that doesn't matter if vendor you use for certs doesn't suck. – Zoredache May 13 '14 at 23:09
Thanks Steffen, I've found little written on alternative names. I will keep on searching. Where do I add this alternative names? Do all certificate providers offer them? – user1032531 May 14 '14 at 1:27
@Zoredache GoDaddy seems to offer three options (as of today's date): Protect One Website starting at $69.99 /year, Protect Multiple Websites starting at $134.99 /year, And Protect All Subdomains ("Wildcard") starting at $269.99 /year. How is this relevant to your comment? Thank you – user1032531 May 14 '14 at 1:33
@user1032531, With that $270 wildcard cert Godaddy seems to automatically add the SAN for the bare domain for you. So if you provide a CSR for *.domain.tld, they give you a cert that is valid for *.domain.tld, and domain.tld. Other providers may do the same, but I haven't used them. See the examples on this page… – Zoredache May 14 '14 at 2:45
I have no experience with the sellers of the certificates, but I know the standards and their use in the browsers. So if your CA throws in if you order * that's good - although it does not help if you need and too. If you look at certificates from google or other big companies they have usually lots of names as alternative names, and you can put wildcards there too. Actually you must have the CN also in subject alternative names (SAN), because if SANs are there the browser will not look at the CN anymore. – Steffen Ullrich May 14 '14 at 4:29

When I had a certificate issued for a domain, my provider helpfully added www as a Subject Alternative Name, like so:

enter image description here

(pardon my horrible censoring) So the answer is, not usually. Most providers do this automatically. Ask your provider if you're not sure or if the certificate they do issue you lacks this field.

Note: This is the very basic certficate (the $9 one that certain providers often provide for free) and it has a SAN, so it's a cheap alternative.

There's also UCC certificates that are even better than wildcard certificates because they can cover more than one domain name. They also use the SAN field to list domains, so this field is not limited to just a single domain name, either.

share|improve this answer
I've also seen this on the free StartSSL certificates, GoDaddy certificates, and many others. This pretty much covers it. – Michael Hampton May 14 '14 at 17:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.