1

I have a hosted service and have been issuing domain names to clients in the form clientxyz.ourdomain.com. Now we want to offer clients the ability to specify their own domain and Alias (CNAME) it to our servers (e.g. product.clientdomain.com points to clientxyz.ourdomain.com).

The issue is with SSL -- all interaction take place over https. The cert is issued for our domain name *.ourdomain.com and hitting the site with the client's domain generates a certificate error.

I am not 100% but I think I have seen others do this automatically. What do I need to do to make this work? Install another certificate for each client that wants a custom domain? Is there an easier solution? Best case is something I program to happen automatically after a client makes the CNAME change on their end.

4 Answers 4

2

Yeah... I've been here before.

You will have to install a dedicated cert for each client in order for this to work properly. It is certainly one of the more frustrating issues when trying to make this sort of thing happen, but makes sense when you think about it.

1

They are going to have to transition URLs at some point to your TLD. Then you can use a wildcard SSL certificate to secure them. The wildcard only works for the host portion not the TLD which is why at some point you will have to transition URLs. Typically they would do this on a site that they control which is covered by their certificate and then do a 301 to the URL where you host things.

0

You are not going to be able to generate SSL certificates for your client's custom CNAME records that point to your domains. The only option you might have is to redirect connections using the CNAME to clientxyz.ourdomain.com on HTTPS. The client could only use HTTP on product.clientdomain.com unless they also supply you an SSL certificate with private key.

0

Two options:

  1. Install certs for each client domain, with their own static IP.
  2. Have the client CNAMEs go to a regular HTTP page, which redirects to your normal HTTPS page.

You can't directly CNAME a different domain to an SSL site and have the cert work.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .