2

I am new to SSL certificates and their setup. I have not found any details regarding this so I am asking what may be simple question.

I am going to order an SSL certificate so I want to know if an SSL certificate with the specified common name example.com also works for example.com/app1/payment.

Improve this question

2 Answers 2

Reset to default
8

Yes. The domain needs to match the CN specified in the cert. SSL certs have nothing to do with any of the rest of the URL.

Improve this answer
3

EEAA's answer is correct so I won't repeat that, but there's plenty to add on the subject of SSL/TLS.

A certificate for example.com won't necessarily match www.example.com as these are different domains. Most providers will automatically include the www subdomain as a Subject Alternative Name when generating your certificate, (even the completely free CAs such as StartCom do this) but you should make sure that they actually do this before you ask them to generate the certificate.

You can buy a SAN certificate (also known as UCC or Unified Communications Certificate) that will allow you to have more than just the single subdomain in the same certificate, so you can buy one certificate to match example.com, www.example.com, shop.example.com and login.example.com. You can even have other domains included in a SAN certificate, so the same certificate can cover example.net, example.info and example.co.uk (and the subdomains for all of those, although having more domains usually will cost you more).

Alternatively, you can buy a wildcard SSL certificate that covers every subdomain for a single domain.

Whether you are getting a single domain certificate, a SAN certificate or a wildcard certificate, there are three types of validation you can go through:

  1. Domain validated certificates are the quickest and cheapest type. The CA will verify that you control the domain you want the certificate for, typically by sending an email to one of the standard email addresses (such as [email protected]) at that domain and verifying that you received it. These are fine if your website is your primary point of authority. Google uses domain-validated certificates.
  2. Organisation-validated certificates will take longer to process and cost more as they need to verify that the domain in question matches a physical address that is owned by the organisation whose name is on the certificate. This can often be accomplished with an automated phone call and can still be fairly quick.
  3. Extended validation (or EV) certificates take this several steps further and aim to establish the legal identity and appropriate authority to obtain the SSL certificate. These are the certificates that turn your browser URL bar green. Needless to say, they cost quite a bit more. Wildcards are not available in EV certificates.

The encryption used is the same in all of these certificates. The level of security provided is dependent on the key size you choose (you should choose 2048), the ciphers and versions of the SSL protocol your web server supports (this can be changed in your configuration). The main trick here is to not support the older, weaker ciphers and versions.

When it's time to go shopping, SSLShopper is the place to do it.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .