I am in the process of enabling HTTPS on my web sites. I have a web site, let's call it example.com, which is available both with and without a www. prefix.

I can now:

  1. request one SSL certificate for example.com and another one for www.example.com or
  2. request a single SSL certificate for example.com with a SAN for www.example.com.

I am aware that, from a security point-of-view, both solutions are fine (which is why I ask this question here instead of at security.stackexchange.com). Certificate renewal will be automated and the certificates themselves are free of charge (using Let's Encrypt).

Is there any reason to prefer one option over the other?

  • Is there a reason that the site is available with www and without? If you 301 redirect one to the other, this entire issue disappears. – Ivo van der Veeken Sep 13 '17 at 15:34
  • 2
    @IvovanderVeeken: How would this issue disappear if I 301 redirected one to the other? As far as I know, SSL verification is performed by the browser before executing redirects. – Heinzi Sep 13 '17 at 15:35
  • Never mind, I was getting a few details mixed up. The SSL handshake happens before the redirect. – Ivo van der Veeken Sep 13 '17 at 15:41

You would just need to order the one cert for example.com. The www is part of it or included by default. If you wanted other sub-domains, ie server.example.com, then you would either need a wildcard domain cert [*.example.com] or order two to cover the extra domain. Hope this helps answer your question.

  • As a small niggle, since OP specified "Let's Encrypt", it's probably worth mentioning that the inclusion of "www" as a default SAN might not be automatic (depending on the method used to obtain the certificate). Also, "Let's Encrypt" won't technically be offering wild cards till January 2018. Otherwise, good info. =) – Anaksunaman Sep 14 '17 at 7:41

Is there any reason to prefer one option over the other?

Assuming the use of Let's Encrypt and that each certificate lists just the www and non-www versions of a single domain, the only likely drawback to using a SAN certificate is the possibility of some compatibility issues with older browsers, mostly prior to 2003.

On the positive side, there would be only a single certificate to automate for each primary domain (e.g. [www.]example.com). However, you might still want separate certificates for true sub-domains (e.g. sub.example.com) in case they need to be updated... so this could be a tossup benefit-wise.

As a purely personal opinion, I see no reason not to use a SAN certificate in this instance unless browser compatibility is a priority.

  • 1
    Thanks. Since we have other domains on that IP as well, we will use SNI, and, thus, older browsers won't be supported anyway. – Heinzi Sep 14 '17 at 7:26
  • Welcome. Glad to be of assistance. =) – Anaksunaman Sep 14 '17 at 7:30
  • 1
    SAN certificates have wider support than SNI. Assuming that you are going to host both on the same server, a single SAN certificate would be preferable to two certs served with SNI. If you are on a shared host with lots of other sites you are going to be using SNI no matter what though. – Stephen Ostermiller Sep 14 '17 at 11:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.