I have a web application/website that lives at
example.com. Everything runs on AWS (my web app runs on Elastic Beanstalk). I use AWS Certificate Manager to issue a certificate for
*.example.com and all works well.
I have a client who would like to white-label the web app so it shows his domain, not mine, in the URL bar. So I've been testing things out with a separate domain name I have
example2.com. I set up a CNAME to point to my Elastic Beanstalk application and everything works great, except when accessing it through
example2.com the site shows as insecure.
So I generate a new certificate, adding in
*.example2.com as an additional name (this would be the client's domain name). Now I can securely access my entire website/web-app with the second domain name as well exactly the same way I would if I used my original domain name.
Are there any risks associated with what I'm doing? Namely, allowing the client to CNAME direct to my load balancer/elastic beanstalk application, and adding his domain to my SSL certificate.