I am in the process of enabling HTTPS on my web sites. I have a web site, let's call it example.com
, which is available both with and without a www.
prefix.
I can now:
- request one SSL certificate for
example.com
and another one forwww.example.com
or - request a single SSL certificate for
example.com
with a SAN forwww.example.com
.
I am aware that, from a security point-of-view, both solutions are fine (which is why I ask this question here instead of at security.stackexchange.com). Certificate renewal will be automated and the certificates themselves are free of charge (using Let's Encrypt).
Is there any reason to prefer one option over the other?