Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I would like to set up an EV SSL certifcate for a few subdomains like blog.domain.com and www.domain.com. I also need to set up a wildcard PositiveSSl cert for *.domain.com, excluding blog.domain.com and www.domain.com.

Will the two certificates interfere with each other. Is this even possible to do?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Assuming the websites are on differenr servers, or using different IP addresses, or supports SNI you wont have any problems.

Those limitations are to ensure the correct certificate is presented. If they are on different servers or IP addresses, no problem - just set each up with the cert you want to use. Otherwise SNI (server name identification) allows your web server to know which hostname was requested so it can present the appropriate certificate.

Technically, the wildcard cert will be valid for blog.example.com as well - there is no way to make a certificate for * except a, b, and c. But you can have multiple certificates valid at the same time for the same domain, you just have to ensure the certificate you want presented for each site is sent by the server.

It is not uncommon to have multiple certificates for the same hostname, or a wildcard cert and several specific ones. One reason you might to so is to have a wildcars cert for a server you run, but a regular cert for a mailserver hosted by a third party. This way they can't pretend to be anyone but mail.example.com, and if their private key is compromised you don't have to rekey the other servers.

share|improve this answer
    
What about it the SSL is being terminated by haproxy on a single IP? That means it cannot work? –  Errol Fitzgerald May 24 '14 at 4:57
    
@errolfitzgerald HAProxy supporrs SNI which will work with many (but not all) browsers, or you can assign more IP addresses to the haproxy, so it has one for each certificate you use. –  Grant May 24 '14 at 5:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.