Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a hosted service and have been issuing domain names to clients in the form clientxyz.ourdomain.com. Now we want to offer clients the ability to specify their own domain and Alias (CNAME) it to our servers (e.g. product.clientdomain.com points to clientxyz.ourdomain.com).

The issue is with SSL -- all interaction take place over https. The cert is issued for our domain name *.ourdomain.com and hitting the site with the client's domain generates a certificate error.

I am not 100% but I think I have seen others do this automatically. What do I need to do to make this work? Install another certificate for each client that wants a custom domain? Is there an easier solution? Best case is something I program to happen automatically after a client makes the CNAME change on their end.

share|improve this question

migrated from stackoverflow.com Nov 5 '09 at 18:35

This question came from our site for professional and enthusiast programmers.

add comment

4 Answers

up vote 1 down vote accepted

Yeah... I've been here before.

You will have to install a dedicated cert for each client in order for this to work properly. It is certainly one of the more frustrating issues when trying to make this sort of thing happen, but makes sense when you think about it.

share|improve this answer
add comment

They are going to have to transition URLs at some point to your TLD. Then you can use a wildcard SSL certificate to secure them. The wildcard only works for the host portion not the TLD which is why at some point you will have to transition URLs. Typically they would do this on a site that they control which is covered by their certificate and then do a 301 to the URL where you host things.

share|improve this answer
add comment

You are not going to be able to generate SSL certificates for your client's custom CNAME records that point to your domains. The only option you might have is to redirect connections using the CNAME to clientxyz.ourdomain.com on HTTPS. The client could only use HTTP on product.clientdomain.com unless they also supply you an SSL certificate with private key.

share|improve this answer
add comment

Two options:

  1. Install certs for each client domain, with their own static IP.
  2. Have the client CNAMEs go to a regular HTTP page, which redirects to your normal HTTPS page.

You can't directly CNAME a different domain to an SSL site and have the cert work.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.