What is the best practice to use SSL certs for subdomains?

The goal is to generate one certificate for the domain y.com and then use it for subdomain x.y.com?

Is it correct practice or it's best to generate separate certs for y.com and x.y.com?


1 Answer 1


Unless you have bought a certificate which has the subdomain as a Subject ALT Name value then yes, otherwise you need a wildcard certificate.

Basic ssl certs for domain.com generally will not support sub.domain.com.

Best practice is probably more a matter of taste, for sake of easy management, it's probably easier to have a wildcard cert or multi-domain certificate. However if one of the domains or machines running the cert gets compromised and you need to revoke the certificate, you have to revoke the whole certificate, not just a single domain. So if this is for a lot of machines this is perhaps not recommended.

Ultimate security of certificates would come down to having different private keys and seperate individual certificates, but for lots of sites this could become a management issue.

  • 1
    Thanks @anthonysomerset. Is the wildcard certificate the one which has Common Name = *.y.com? I am actually creating certs with openssl now.
    – Vladimir
    Sep 18, 2011 at 17:44
  • 1
    correct wildcard is *.domain.com Sep 19, 2011 at 6:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .