My company's development team is in process of developing two sites that will have two separate domain names (let's say foo.example and bar.example), but will be hosted on a single cloud Linux/Apache server.
Do we need to purchase SSL certificates for each domain (one for foo.example and one for bar.example), or do we just need one for the server? And are there any specific security concerns that need to be taken in to account when using SSL in this environment?
At this point in time, Get Started with Let's Encrypt. You can specify multiple domains on one certificate.
certbot -d domain1,domain2 ...
If by contrast you want to serve different certs for the different domains on your server, configure server software to use TLS Server Name Indicator (SNI) Extension.
Differing Certificate types don't have much value going forward, see Troy Hunt's Extended Validation (EV) Certificates are Dead and browsers are phasing them out. EV certificates were the most involved to get, and claimed to offer a higher level of assurance. This claim is some combination of no longer true and no longer useful.
If you want to provide HTTPS connections to both domains, you'll need a separate SSL certificate for each one. If you try to use just one for the server, visitors will receive a domain mismatch security error in their browser.
Each SSL will require a separate IP address, as standard SSL certificates are assigned to one domain and one IP address. If you've only been assigned one IP address for your account, you'll have to request another (non-shared) IP address from your web hosting company or ISP.
SSL certificates only secure the connection between your web server and client browsers, so you'll need to employ good security practices on your server if you'll be storing sensitive data. How to do so, and whether cloud-based web hosting is secure, is out of the scope for this question, but a worthwhile consideration in that case.
Adding an additional SAN certificate (Subject Alternative Name) with SSL Certificate purchase, can secure multiple domains on single server.
If you want to secure two domains on single server, then you should buy a 1 certificate with adding a 1 SAN certificate during purchase.
Below table shows the number of domains on single server with requirement of SSL Certificates:
2 domains = 1 Certificate + 1 SAN 3 domains = 1 certificate + 2 SANs : : : : N domains = 1 Certificate + (n-1) SANs
Generally, Major certificate Authorities allows you to add additional SAN up to 24. It may vary by Certificate Authority.
There are three types of SSL Certificates DV (domain validated), OV (organization validated) and EV (extended validation) certificates. You should buy OV or EV certificate, because it has better SAN option then the DV certificate.
