Certificates in Multiple Servers (AWS Instances)

Question

We have 1 WHM Licence (instance in AWS). Inside the WHM we create one account MYDOMAIN.EXAMPLE -this is the MAIN DOMAIN-.

Inside the DNS of the MAINDOMAIN.EXAMPLE we create a few subdomains example CLIENT1.MYDOMAIN.EXAMPLE, CLIENT2.MYDOMAIN.EXAMPLE, CLIENT3.MYDOMAIN.EXAMPLE and those are pointing to diferent instances in another AWS Instances with an "A Record".

In total we have 7 Instances in AWS with diferents IPs so we have something like this.

CLIENT1.MYDOMAIN.EXAMPLE - IP 192.0.2.1

CLIENT2.MYDOMAIN.EXAMPLE - IP 192.0.2.2

CLIENT3.MYDOMAIN.EXAMPLE - IP 192.0.2.3

CLIENT4.MYDOMAIN.EXAMPLE - IP 192.0.2.4

etc,

Every instance have a WebServer in nginx. Each has to have 1 certificate...

How can I do this? A wildcard is going to work? Or i need to buy diferent certificates for each subdomain?

Answer 1

You are mixing two things that are completely unrelated for the question you ask: whatever DNS setup you have, at the end, a given name is just mapped to a given IP and then the web browsers connects to that IP.

Now if doing some kind of TLS handshake (HTTPS) the browser will expect the proper certificate from the server.

If you manage multiple names (on multiple servers or not, this does not change much the consequences, nowadays with SNI multiple HTTPS virtual host on one IP is not a problem anymore) it is up to you to choose how you will handle your certificates:

• either one certificate per name (typically with the relevant www. version as Subject Alternative Name)
• or one certificate with the list of all names in the SAN section; major drawback is not technical but the fact than people will then see all different names in the certificate, even if they are completely unrelated. Also CAs will only allow up to some hundreds of names as SANs so that does not scale indefinitely. But you have only one certificate to handle and to remember to renew, while in previous case you will need to have a good calendar to remember renewing all of them on time (or you just automated renewals like in Let's Encrypt case)
• or, in the specific case of names under the same root, you can try to use a wildcard, but I do not think you are in such setup; a wildcard would work for all your names above, that is with *.mydomain.example but then it means this is also the URL seen in the address bar, which I am not sure is what you want.