3

I have 2 sub-domains one for support and other for billing. I just wasnt https on these two not the main site. Can i use 1 SSL Certificate on two sub-domains, or i will need to buy two certificates ?

4

There are only 3 types of SSL certs that I'm aware of. One of the problems of using multiple certificates is that each requires it's own IP address. While your web server may offer unlimited subdomains the number of IP addresses you have may be limited.

  1. A standard SSL certificate will only work for 1 domain, and it has to be the domain the certificate is registered for.

  2. A multi-site SSL certificate can be registered to work with more than 1 domain. You could register 3 domains that are completely different under this one certificate, but it's not flexible as the cert is fixed to those domains.

  3. A sub-domain SSL certificate can be registered to work on ALL sub-domains of a master domain. Unlike the multi-site above this is a wildcard for subdomains and you can add/remove sub-domains as you need.

Each of the above have different costs per year.

  • Thanks @Mathew. This means Sub-domain is the type of SSL i should look for ? – Prateek Dec 28 '14 at 6:51
  • You can actually use two or more certificates on the same IP under different vhosts, it depends on your webserver, look up SNI. – chrki Dec 29 '14 at 0:50
2

https://en.wikipedia.org/wiki/SubjectAltName may be what you are looking for. Most CAs offer these, at least if you ask them.

  • Link about SAN and Wild card certificate was very informative. Thanks – Prateek Dec 28 '14 at 16:12
3

First thing to do is decide whether you need to support Windows XP users using Internet Explorer 6. Check your visitor logs and consider that these users already have bigger security issues and may not be the most profitable, and they require a more complicated and expensive set-up.

If you are okay with leaving XP + IE6 behind, you should use SNI (Server Name Indication) certificates which work on any modern OS & browser combination. You don't need to worry about a fixed IP address as SNI certificates are tied to the domain name (or sub-domain name) and can be used from any IP address.

The most sensible thing to do is skip the more expensive wildcard certificates and buy two certificates for your subdomains. I have used both gogetssl.com and cheapsslsecurity.com for inexpensive Domain Validated "Comodo PositiveSSL" certificates and both sites offer them for under US$6/year.

Even better, if you can wait until mid-2015 you can get them for free using the new Let's Encrypt Certificate Authority.

  • wow, seriously I didn't know there were that many different types of certificates. Thanks for the gogetssl.com link. Very informative way to shop for SSL. – Reactgular Dec 28 '14 at 14:32
  • 1
    IE 8 on Windows XP has the same lack of SNI support as IE 6 on Windows XP. – Damian Yerrick Dec 29 '14 at 21:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.