Webmasters Stack Exchange is a question and answer site for webmasters. It only takes a minute to sign up.
Sign up to join this community
Some customer gave me the input that if you have a website with a domain like
https://www.example.com
which has a lot of secondary domains only redirecting like
https://www.example.eu
https://www.example.is
requires an SSL certificate for each redirecting domain because somebody might visit https://www.example.eu with HTTPS and then they get a warning in their browser. Is this true? All requests are redirected to the main .com domain.
HTTP redirects happen AFTER the TLS handshake.
For the TLS handshake to be successful, the server has to present a valid certificate, having in it the hostname that is in the URL being accessed, otherwise browsers will show errors.
So the rule is simple: as soon as you see an https:// URL, even if all accesses to it are finally redirected to another URL, you need a certificate for the hostname in that first URL.
Just to be clearer: it does not need necessarily a separate certificate, as a given certificate can encode multiple hostnames in its "Subject Alternative Names" extension (with some limits defined by CAs, like 100 names at most). It can be debated if it is better to have one certificate per name or one certificate covering all names. There is no clear cut here, as it depends on many factors, like administration of those certificates (and their renewals) and controls of the underlying websites and/or nameservers. A given certificate with all names in it however means the fate of all websites is shared: if that certificate is not correctly renewed, or if you need to add names or remove them from it, you need a new certificate and hence revalidating ALL names in the certificate at the same time, which can be cumbersome.
