I wish to have an SSL certificate covering legacy domains (DNS will point all domains to the single web server, our exchange will also handle incoming email from multiple domains). I have found a "multiple wildcard in SAN" SSL provider.

The SSL provider states:

By default, this product will secure 2 wildcard domains (for example: *.yourdomain.com and *.domain.com) and must have a non-wildcard domain (for example: yourdomain.com) listed as the base domain, or Common Name (I will need to "add on another wildcard domain" to the purchase obviously as I need 3x wildcard domains)

As for generating the REQ for the provider (Using IIS 7.5), would I generate a normal SAN request with wildcards in the SAN?

For example, I need to cover *.mydomain1.com *.otherdomain1.org and *.yetanotherdomain.net

so I'm guessing I need a "proper" common name - mydomain1.com then add wildcards as SANs:

  1. *.mydomain1.com
  2. *.otherdomain1.org
  3. *.yetanotherdomain.net

My question; is my approach correct?


First you should request Multi-Domain Wildcard SSL certificate for any of your main domain using asterisk (*). i.e. *.mydomain1.com

Afterwards, you should add additional domains *.otherdomain1.org and *.yetanotherdomain.net to same SSL certificate. To cover all these domains in single certificate, you will require to purchase one more SAN (as you have mentioned about default pack is of two domains). I would suggest to check this post, if you have any confusions regarding the best suitable certificate upon your requirement.

If your main domains and sub-domains exist on same server, you will need to install certificate only once. But any of your domain(s)/sub-domain(s) is on another server, you will require to reissue certificate and install it on different server. Kindly note, some providers offer free re-issuance while few charge for it, so confirm first.

It seems like, your approach is correct, you should purchase Multi-domain Wildcard certificate to protect sub-domains from different sites (*.mydomain1.com, *.otherdomain1.org, *.yetanotherdomain.net, etc.).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.