I have a webservice which provides simple site constructor functionality with payment page.

User can select purchase domain e.g. user.com, select some template and point this domain with CNAME to my webservice e.g. site.constructor.com.

And there are a lot of such user's sites, and all they point to the site.constructor.com.

Webservice site is covered with wildcard certificate *.constructor.com, hosted on AWS and SSL certificate is applied to the Load Balancer HTTPS handler.

Now when anyone navigates https://user.com he gets appropriate content from sites.constructor.com, but before that he receives warning window, that user.com doesn't contain correct certificate (because host certificate become used).

And now I need to make https://user.com secured, but can't understand how to do that.

I have no any load balancer configuration, or webservice configuration for this domain. the only entrance is CNAME and DB record with user domain name. So I can't even simply purchase a new certificate for user domain and apply it.

What is the best way to secure CNAME domain?

UPD.1. user's domain access flow

1. Navigate _https://user.com_
    there is only domain control panel with CNAME which points to the _site.constructor.com_
2. call to the AWS load balancer of _site.constructor.com_ with applied SSL (SSL is NOT for _user.com_)
3. access to the EC2, etc...

Where should be user.com certificate be applied? is that possible to use self-generated certificate in this case for user.com?

  • Free certificates for domains and one sub-domain at startssl. – kgimpel Jan 15 '16 at 23:26
  • 1
    The correct question how to secure domain, it is not depends from CNAME or A or AAAA or whatever. – kgimpel Jan 15 '16 at 23:27

There being a CNAME record rather than a direct address record (A/AAAA) is not a factor. The certificate verification is based on the hostname in the location URL.

For navigating to https://example.com/ to work, you would need a certificate that is valid for example.com. Ie, a certificate that either has example.com as the Subject CN (Common Name) or that has example.com in its SAN (Subject Alternative Name) list.

  • see UPD.1. for comment – deeptowncitizen Jan 16 '16 at 6:44
  • @deeptowncitizen It says "1. Navigate https ://user.com", which is the same as the original text said (which my answer is based on). A proper certificate for that domain is required at whichever service is terminating TLS, or there will be validation errors. – Håkan Lindqvist Jan 16 '16 at 11:47
  • sure. but the main question how to inject SSL certificate before constructor's one? as I have only domain control panel with CNAME record. – deeptowncitizen Jan 16 '16 at 19:41

In addition to Håkan Lindqvist, an answer regarding your update:

Where should be user.com certificate be applied?

At the machine which terminates your HTTPS / TLS.

Is that possible to use self-generated certificate in this case for user.com?

Of course...but using these would give your visitors cert warnings (assuming the CA cert isn't known / trusted in their browsers). If you would like to prevent this, you need to get certs signed by a known and "trusted" CA. (If we're talking about many domains, maybe have a look at Let's Encrypt: "It's free, automated and open".)


In addition to the other answers, note that if your server is handling SSL/TLS for many different domains, you will either need to have a single certificate covering all of the domains or have Server Name Indication (SNI) configured on the server to enable it to use different certificates for different domains. The client also needs to support SNI, but all modern web browsers do, though note that most browsers on Windows XP do not. (In theory there's a third option, which is to have a multi-homed server using a different IP address for each domain, but I think that's unlikely to be feasible for you.)


You have to redirect the request directly to your subdomain. This is an hidden redirection and so here is no valid certificate for the requested domain.

  • 2
    If the user navigates to https://example.com/ (as per the question) you cannot handle the request (whether to redirect or to do anything else) without first presenting a valid certificate. – Håkan Lindqvist Jan 16 '16 at 0:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.