Using wildcart certificates

Question

Can I buy a wildcart certificate to use the same SSL certificate on multiple domains such as:

www.website1.com www.website2.com ... etc

(on different hosting services) ?

If yes

(1) Is this a good and cheap solution ? (2) What could I risk ?

Answer 1

This is not how wildcard certificates work.

Wildcards are only for subdomains. I.e. a wildcard certificate for example.com will apply also to all subdomains, e.g. a.example.com, b.example.com, c.example.com etc. Basically you can view the wildcard expression as *.example.com.

There is (as far as I know) no way to have a single certificate that covers both website1.com and website2.com, except (as Farseeker pointed out in his comment) to issue a *.com wildcard that would apply to all .com domains. No reputable certificate authority would ever issue such a certificate, and if they did they would cease to be reputable very quickly!

Answer 2

Kris answer regarding wildcard certificates is correct (+1) - however, figuring from your related question that you might be more concerned about not having to buy separate certificates for each domain rather than sharing a single certificate technically (e.g. to reduce administrative overhead), I'd like to second gbroiles recommendation of startssl.com for their (to the best of my knowledge) still unique offering in this regard specifically:

• They are relatively inexpensive (or free even) compared to many other commercial providers in the first place due to their different approach to validation/certification, that is, they initially validate persons/organizations only, the later certificate generation and management thereafter is mostly automated and hence free of additional cost.

• This approach essentially allows you to generate certificates for as many domains as you please yourself (see FAQ 27: For what am I paying exactly and how many certificates do I get with Class 2?).

  • Wildcard certificates for subdomains are still supported, of course, though their need/usage is implicitly reduced to cases where it makes sense semantically/technically, because it is obviously no problem to generate a sub domain specific certificate for free as well, if need be.

You might end up with slightly more administrative effort initially than with the more expensive providers (not necessarily though) and a slightly reduced client root certificate coverage than with the larger providers (constantly decreasing issue with recent client/browser versions), but other than that you'll feel (and be) in control to cover all your needs at minimal cost.

This solution works very well for us, after switching to StartSSL we never looked back.