Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Currently we are deploying a beta API for our services and we want that all request/responses from the API works over https. I'm confused about using wildcard certificates for both api and www urls. Is it a good idea to use a wildcard certificate for both api.example.com and www.example.com? Are there any inconveniences?

What about those 1-server-only certificates? Because I'm deploying my API in n servers with a load balancer on front.

share|improve this question
    
Certificates are tied to their domain names (or in the case of a wildcard, *.domain) - you can deploy the one certificate to dozens of servers without issue. We do this now with a load balancer, you just need to remember to update every certificate on every server when renewal time comes. –  Mark Henderson Jul 16 '10 at 0:23

2 Answers 2

up vote 4 down vote accepted

You are correct, using a wildcard cert is a great idea in this case. It'll keep your configuration for separate domains simple, and ensure that any subdomains you decide to add will work.

There are a couple drawbacks:
- Your top level domain is not secure. As in, the certificate is not good for example.com.
- They are very expensive, normally around $1k.

As for 1-server-only certs, it depends on the agreement you make when you purchase the cert. Some will allow the cert to be installed on multiple servers, some will not. Also, I have no idea how or if they check that the cert is only installed on a single server. You might be able to get away with it...

Also, if you are using a load balancer, I would recommend installing the cert there, if your hardware allows it. I know the Cisco CSS series has a dedicated hardware module that handles all the encryption and decryption, saving some work for your servers.

share|improve this answer
3  
Digicert wildcard SSL is 1/2 to 1/3 that price and is flexible (multi server installs). We've been using them for a couple years and it has worked out well for us. –  JasonBirch Jul 16 '10 at 0:14
    
Godaddy.com sells wildcard certs for around $200/year. I've been using them for going on 3 years right now and haven't had a problem with any browsers accepting them. –  dragonmantank Jul 17 '10 at 13:17
    
Digicert certificates will also secure the base domain (i.e. no subdomain) which most other providers need you to buy an additional certificate for –  Gareth Feb 24 '12 at 12:03

The only problem that I've seen with wildcard certs so far is that they don't appear to have any that support EV. This is only really a concern if you want the cool browser chrome saying "hey, this site is offically OK and vertified". If you're only looking for secure transport and don't care about customer purchasing confidence, go the cheap way. Or buy EV for the www server, and wildcard for the API.

share|improve this answer
    
I'm ok with that, I expect my bank to have an EV, but not me –  licorna Jul 16 '10 at 23:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.