Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a hosted service and have been issuing domain names to clients in the form Now we want to offer clients the ability to specify their own domain and Alias (CNAME) it to our servers (e.g. points to

The issue is with SSL -- all interaction take place over https. The cert is issued for our domain name * and hitting the site with the client's domain generates a certificate error.

I am not 100% but I think I have seen others do this automatically. What do I need to do to make this work? Install another certificate for each client that wants a custom domain? Is there an easier solution? Best case is something I program to happen automatically after a client makes the CNAME change on their end.

share|improve this question

migrated from Nov 5 '09 at 18:35

This question came from our site for professional and enthusiast programmers.

up vote 1 down vote accepted

Yeah... I've been here before.

You will have to install a dedicated cert for each client in order for this to work properly. It is certainly one of the more frustrating issues when trying to make this sort of thing happen, but makes sense when you think about it.

share|improve this answer

They are going to have to transition URLs at some point to your TLD. Then you can use a wildcard SSL certificate to secure them. The wildcard only works for the host portion not the TLD which is why at some point you will have to transition URLs. Typically they would do this on a site that they control which is covered by their certificate and then do a 301 to the URL where you host things.

share|improve this answer

You are not going to be able to generate SSL certificates for your client's custom CNAME records that point to your domains. The only option you might have is to redirect connections using the CNAME to on HTTPS. The client could only use HTTP on unless they also supply you an SSL certificate with private key.

share|improve this answer

Two options:

  1. Install certs for each client domain, with their own static IP.
  2. Have the client CNAMEs go to a regular HTTP page, which redirects to your normal HTTPS page.

You can't directly CNAME a different domain to an SSL site and have the cert work.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.