I have a web application/website that lives at example.com. Everything runs on AWS (my web app runs on Elastic Beanstalk). I use AWS Certificate Manager to issue a certificate for *.example.com and all works well.

I have a client who would like to white-label the web app so it shows his domain, not mine, in the URL bar. So I've been testing things out with a separate domain name I have example2.com. I set up a CNAME to point to my Elastic Beanstalk application and everything works great, except when accessing it through example2.com the site shows as insecure.

So I generate a new certificate, adding in *.example2.com as an additional name (this would be the client's domain name). Now I can securely access my entire website/web-app with the second domain name as well exactly the same way I would if I used my original domain name.

Are there any risks associated with what I'm doing? Namely, allowing the client to CNAME direct to my load balancer/elastic beanstalk application, and adding his domain to my SSL certificate.


That will work fine, it's a standard way to do things.

Beware though your website has to generate relative URLs, otherwise the users will end up on example.com. For example links to the contact page should be

<a href="/contact">Contact Us</a>


<a href="https://www.example.com/contact">Contact Us</a>
  • Wonderful, thanks for the re-assurance. Aside from the risk of the customer tricking people into thinking our brand is reflective of their subdomain (which would be hard since the content on the page is all our brand), I'm glad to know there aren't any security threats. All URLs are relative, yup! – capcom Apr 26 '17 at 19:02
  • Off the top of my head I don't think it adds any technical security threats. – Tim Apr 26 '17 at 19:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.