I need to implement SSL for my Web Application. I've never done this before so I want to be sure I'm going to do the right thing.

My Setup:

  • Webserver1 for the public Site
  • Webserver2 for the Web Application (Virtual Ubuntu Server)

www.mydomain.com has a DNS A Record to Webserver1.

My Webserver2 has no static IP Adress, just a DNS Name.

www.login.mydomain.com has a CNAME Record to Webserver2 (DNS Name).

Now I would like to protect www.login.mydomain.com with SSL.

My questions:

1.) Can I buy a certificate just for the URL www.login.mydomain.com OR do I need to buy a Wildcard certificate for www.mydomain.com?

2.) www.login.mydomain.com directs to the root folder, via htaccess I point to the application folder /app. Could this be a problem?

3.) Should I get for my Webserver2 a static IP Address? So I can set an A record instead of a CNAME record?

Many thanks for your support

  • One does not buy certificates any more. One gets them for free from Let's Encrypt.
    – womble
    Sep 5, 2016 at 6:24
  • thanks for that comment. I tried Let's Encrypt and it works fantastic!
    – Timon
    Sep 7, 2016 at 15:02

1 Answer 1


Static IP addresses and name DNS configuration don't really affect your certificate. Whatever FQDN will be in the request to the server should match the certificate.

If your request is for www.login.mydomain.com then that's what should be in the certificate, regardless of whether it's an A record, a CNAME or even an entry in etc/hosts. Name resolution takes place at the client (browser), which then sends the FQDN as part of the request to the server. It's this FQDN that's checked to see if a certificate is valid for that domain.

Also, if this dev server is just for you, then there is no need to purchase a commercial certificate (although they are cheap these days). You could simply make your own with, for example, OpenSSL.

To answer your questions:

  1. You could buy a wildcard cert, but it will cost you much more. A separate certificate would be much cheaper (or just make your own).

  2. Certificate chain-building only checks the FQDN - not the full URL. Anything after the / is ignored.

  3. It might be easier to manage for you, but it's not mandatory. This has nothing to do with certificates, but is a simple name resolution issue.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .