0

We have 1 WHM Licence (instance in AWS). Inside the WHM we create one account MYDOMAIN.EXAMPLE -this is the MAIN DOMAIN-.

Inside the DNS of the MAINDOMAIN.EXAMPLE we create a few subdomains example CLIENT1.MYDOMAIN.EXAMPLE, CLIENT2.MYDOMAIN.EXAMPLE, CLIENT3.MYDOMAIN.EXAMPLE and those are pointing to diferent instances in another AWS Instances with an "A Record".

In total we have 7 Instances in AWS with diferents IPs so we have something like this.

CLIENT1.MYDOMAIN.EXAMPLE - IP 192.0.2.1

CLIENT2.MYDOMAIN.EXAMPLE - IP 192.0.2.2

CLIENT3.MYDOMAIN.EXAMPLE - IP 192.0.2.3

CLIENT4.MYDOMAIN.EXAMPLE - IP 192.0.2.4

etc,

Every instance have a WebServer in nginx. Each has to have 1 certificate...

How can I do this? A wildcard is going to work? Or i need to buy diferent certificates for each subdomain?

  • I edited your obfuscation but kept the MAINDOMAIN/MYDOMAIN difference I was not able to understand if this is a typo or what you wanted to say because client1.mydomain.example can not live in the maindomain.example zonefile so there is something not clear here. – Patrick Mevzek Dec 7 '18 at 0:23
1

You are mixing two things that are completely unrelated for the question you ask: whatever DNS setup you have, at the end, a given name is just mapped to a given IP and then the web browsers connects to that IP.

Now if doing some kind of TLS handshake (HTTPS) the browser will expect the proper certificate from the server.

If you manage multiple names (on multiple servers or not, this does not change much the consequences, nowadays with SNI multiple HTTPS virtual host on one IP is not a problem anymore) it is up to you to choose how you will handle your certificates:

  • either one certificate per name (typically with the relevant www. version as Subject Alternative Name)
  • or one certificate with the list of all names in the SAN section; major drawback is not technical but the fact than people will then see all different names in the certificate, even if they are completely unrelated. Also CAs will only allow up to some hundreds of names as SANs so that does not scale indefinitely. But you have only one certificate to handle and to remember to renew, while in previous case you will need to have a good calendar to remember renewing all of them on time (or you just automated renewals like in Let's Encrypt case)
  • or, in the specific case of names under the same root, you can try to use a wildcard, but I do not think you are in such setup; a wildcard would work for all your names above, that is with *.mydomain.example but then it means this is also the URL seen in the address bar, which I am not sure is what you want.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.