My basic quandry is that wildcard certificates don't support subdomains of subdomains, nor do they help with alternate domain names. Basically, if my CN is example.com, I want a Subject Alternative Name field that looks roughly like so:

DNS:example.com DNS*.example.com DNS:*.beta.example.com DNS:example.net DNS:*.example.net DNS:*.beta.example.net

Using a self-signed cert, I verified that the browsers will work just fine with this.

Unfortunately, none of the Certificate Authorities that I looked into (Thawte, GoDaddy, Verisign, Digicert) seemed to support both wildcard certs and Subject Alternative Name (sometimes referred to as "Multiple Domain UCC"). I even called up GoDaddy tech support to confirm. Is there a CA (trusted by 99% of browsers) that supports wildcards for the Subject Alternative Name?

  • 1
    I recommend you edit out the Amazon EC2 stuff and make it a new question. The two topics are not technical related (CA's and EC2 design). Then you'll likely get a better answer to your first question about CA's. – Bret Fisher Mar 10 '11 at 0:03
  • I know it's a month later, but you're right. I'm editing the question now to only be one question. Thanks. – nicholas a. evans Apr 5 '11 at 14:38

Digicert Premium Wildcards support up to 10 (I think) SANs per duplicate. I'm sure others do as well.

  • 1
    According to their site: digicert.com/wildcard-ssl-certificates.htm they'll do it as long as the SANs are subdomains of the issued domain. They also claim this is unique amongst all wildcard cert sellers (though Comodo PremiumSSL automatically added example.com as a SAN for my *.example.com cert), so it may be the best he can do. He might contact them and offer to pay for two wildcard domains if they'll combine it into one cert. – DerfK Mar 10 '11 at 0:23
  • 4
    Thanks @MarkM and @DerfK. We did wind up talking to all of the major certificate authorities, and none of them officially supported this option. However, Digicert was uniquely willing to work with us to get this to work anyway. First we bought separate certificates for all of the domains we needed like normal, and then Digicert manually combined them all into one single cert (using Subject Alternative Names). Maybe if enough people request this, it can become a standard product. – nicholas a. evans Apr 5 '11 at 14:47
  • That's awesome @nicholas! Thanks so much for this info! – cregox May 8 '11 at 2:16
  • By the way, we've just got a 10 SAN within one domain using certs.godaddy and added 2 alternative names like www.main.com, www.alternate1.com, www.alternate2.com and it worked perfectly fine! It's called "Standard UCC SSL", at least with Godaddy. So, not sure if they catch up in 1 month or if they (most likely) always had this, but looks like you have missed something on your research, mr @evans! ;) – cregox May 8 '11 at 3:46
  • Thanks for the note @nicholasa.evans. We ended up going with Digicert because they were able to manually combine them (as you mentioned). – Adam Spicer Oct 3 '12 at 18:42

I know this is an old question. But you can do this with StartCom as well, as long as you have done at least level 2 validation.


Comodo also offers a Multidomain wildcard certificate in their InstantSSL range. Three domains are included.


That isn't the cheapest price, Google for a Comodo reseller and you'll find it for a LOT less.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.