1

I have a domain (my.com) containing 5 subdomains (www.my.com, app1.my.com, app2.my.com, app3.my.com, app4.my.com).

The 4 apps are hosted on a Windows/Apache 2.4 server with a single IP using virtual hosts, while www.my.com is hosted on a second server with a separate IP and may move to a managed hosting service in the future.

I have to secure all of the above subdomains with SSL certificates from Geotrust.

What I need is to:

  1. Choose the appropriate type of certificates that can work in the above configuration (5 subdomains in 2 servers)

  2. Minimize the number of certificates required (for cost and maintenance reasons)

  3. Maintain a generally acceptable degree of security

So, how many certificates should I order and of which type?

4

A single certificate can cover multiple hostnames by using the Subject Alternative Name (SAN) extension. This is often used to cover both www.example.com and example.com, but can be used to cover more hostnames.

In your case you would need 6 names (assuming you also want to use my.com.) SSL providers often call these kinds of certificates SAN Certificates.

Some Certificate authorities allow you to generate the certificate for multiple servers, however there's nothing stopping you from using the same exact certificate on both servers.

You may want to look into Let's Encrypt, which is a certificate authority that issues free certificates.

| improve this answer | |
  • Thanks. Assuming that I have to cover only www.my.com (and not the entire my.com) with the common name my.com, would a certificate with 1 common name and 4 SAN be ok? Because my supplier has exactly that package and I believe it covers me. – Dimitrios Tsalkakis Dec 3 '18 at 12:44
  • 3
    The common name should be included in the SAN list. – Torin Dec 3 '18 at 12:55
  • 1
    +1 @TorinCarey - see stackoverflow.com/questions/5935369/… – fvu Dec 3 '18 at 15:25
2

When you still buy your certificates (and decide not to use Let's Encrypt) generally speaking you have three options:

  1. Get an unique certificate for each URL you use.
    • Pro's : single URL certificates are cheaper than SAN certificates (although a SAN certificate with 20 hostnames may be cheaper that 20 individual certificates)
    • URL's can easily be added, moved to different servers or be removed
    • Conns: more administration for renewals, but relatively straightforward.
    • When multiple URL's are hosted on a server with a single IP-address all clients need to support SNI
  2. Get a unique certificate for each server that you use
    • Pro's: fewer certificates
    • With a single URL on a single server you can suffice with cheap single URL certificate
    • With multiple URL's on a single certificate you will need a (usually more expensive) SAN certificate
    • You can support older clients that don't support SNI
    • Conn's: adding/removing sites on a SAN certificate requires re-issue
  3. Get a single certificate and use the same one on all servers.

    • A SAN certificate requires that you explicitly name each URL that you want to use, but supports different domains (webmail.example.com www.example.com example.co.uk my.example.ca etc.) in a single certificate.
    • A wildcard certificate is typically valid for example.com and every subdomain *.example.com but usually not for other domain names (nor for multiple level subdomains below the wildcard i.e. some.subdomain.example.com is not covered by *.example.com).
    • Pro's: A wildcard is is easy, you can add, move and remove subdomains at will to and from each of your servers.

    • Conn's: A single SAN certificate will need replacing on every server when a site is added/removed on one of your servers.

What makes most sense for you depends on your current needs, anticipated changes and current prices for the certificates and the cost labour to implement, monitor and manage them .

| improve this answer | |
  • 1
    Anything that doesn't support SNI these days is not "older", it is "ancient" and "many years out of support". – Michael Hampton Dec 3 '18 at 15:37
  • 1
    @MichaelHampton I’m quite comfortable with my age but calling stuff without SNI “ancient” makes me feel positively antediluvian – HBruijn Dec 3 '18 at 21:24
  • Well, most of this stuff came out when the years still started with 1.... – Michael Hampton Dec 3 '18 at 23:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.