1

Some customer gave me the input that if you have a website with a domain like

https://www.example.com

which has a lot of secondary domains only redirecting like

https://www.example.eu 
https://www.example.is

requires an SSL certificate for each redirecting domain because somebody might visit https://www.example.eu with HTTPS and then they get a warning in their browser. Is this true? All requests are redirected to the main .com domain.

2

HTTP redirects happen AFTER the TLS handshake.

For the TLS handshake to be successful, the server has to present a valid certificate, having in it the hostname that is in the URL being accessed, otherwise browsers will show errors.

So the rule is simple: as soon as you see an https:// URL, even if all accesses to it are finally redirected to another URL, you need a certificate for the hostname in that first URL.

Just to be clearer: it does not need necessarily a separate certificate, as a given certificate can encode multiple hostnames in its "Subject Alternative Names" extension (with some limits defined by CAs, like 100 names at most). It can be debated if it is better to have one certificate per name or one certificate covering all names. There is no clear cut here, as it depends on many factors, like administration of those certificates (and their renewals) and controls of the underlying websites and/or nameservers. A given certificate with all names in it however means the fate of all websites is shared: if that certificate is not correctly renewed, or if you need to add names or remove them from it, you need a new certificate and hence revalidating ALL names in the certificate at the same time, which can be cumbersome.

| improve this answer | |
  • Not sure if compatibility for SAN is an issue at all these days? Very old browsers and some mobile devices may not support SAN. – DocRoot Jan 18 at 1:30
  • 1
    @DocRoot I am sure there are old clients not supporting SAN, but I think those won't also support TLS 1.2 for example, and hence they have a bigger problem than just missing out SAN feature. (as this year many browsers will stop to support TLS 1.0 or 1.1, as do many websites) – Patrick Mevzek Jan 20 at 16:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.