We plan to have a SSL certificate for our web server which is running multiple independent web applications. Those web applications are running on the same web server but are not related to each other (accessed by www.example.com/sub1, /sub2 and so on). If we have the SSL certificate issued for main domain, in order to put the each web applications on SSL, do we still need SSL certificate for each and every web applications?
2 Answers
It depends on the type of certificate you buy. Common certificates only work for exactly one sub-domain. (example.com or www.example.com).
You can get Subject Alternative Name (SAN) certificates that cover multiple domains or multiple sub-domains in one certificate. When the certificate is issued, all the domains and subdomains are listed on it. If you need to add or remove subdomains from it, you would need to get the certificate re-issued.
You can pay extra for a wildcard certificate that works on a domain and all its first level subdomains (example.com and *.example.com).
answered Aug 24, 2015 at 15:31
Short answer: No, SSL Certificates are registered against a domain (example.com in your example), so unless your apps are running in separate domains you should not need multiple certificates.
Applying the certificate to your applications will vary depending on your web server (Apache, Nginx, etc).
www.example.com/sub1andwww.example.com/sub2are not different subdomains (as suggested by your question's title). If you are actually running your apps on different subdomains (sub1.example.com,sub2.example.com) the answer is a little different.