0

I have a SSL certificate setup for a domain e.g www.abc.com, this domain is customer facing.

On the same server (linux) I want to setup a subdomain that is private for site admin, admin.abc.com.

As htpasswd is not really secure I want to be able to view admin.abc.com using https (unless there is an alternative).

So can I some how use the existing SSL certificate to view admin.abc.com even if that means accepting a warning of a mis-match from the browser?

  • If you want to use the same certificate and don't care about the certificate warning, just set up the new <VirtualHost> like you did for the first host. Or try a configuration like VirtualDocumentRoot... – Capilé Jan 17 '14 at 22:41
2

If you are able to get more than one IP address added to the virtualhost, then you can use two SSL virtualhosts, with each using one of two SSL certificates. The virtualhosts would each need to identify which IP address they should be using e.g. in Apache Httpd:

<VirtualHost x.y.z.a:443>

This might be cheaper than getting a wildcard certificate, but a wildcard certificate if you're willing to pay for, is the easiest to set up.

SNI (Server Name Indication) isn't supported on all browsers, so although this would allow you to serve multiple certificates using only one IP address, if they both need to be accessible in these browsers, it's not suitable. If only www.domain.com only needed to support older browsers, then you could still do this, as if the www.domain.com SSL certificate is the first one loaded, then users without SNI browser support can still get that certificate.

SNI in Apache Httpd only works on some more recent versions, e.g. not available in CentOS 5.

UCC Certificates are beyond your needs, and are usually very expensive, so I'd not recommend that over wildcard certificates.

1

You simply configure it like you would configure a certificate if it was valid for that hostname.

Other options that would not require you to deal with an SSL certificate mismatch:

Relying on an untrusted certificate especially if the traffic is going over the public internet is a horrible idea. Unless you verify the certificate every time you would likely accept a different mismatched certificate that could be a man-in-the-middle attack and not even know it.

1

One solution (but not the cheapest:)) would be to buy a wildcard certificate Otherwise, just create a virtalhost and use the certificate you already have. But you will need to live with the certificate warnings.

0

Get yourself a free cert for the subdomains at http://www.startssl.com/. The process is a pain in the butt, but free certs are free certs. Skip the wildcard certificate and save a little money for now.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.