Currently we are deploying a beta API for our services and we want that all request/responses from the API works over https. I'm confused about using wildcard certificates for both api and www urls. Is it a good idea to use a wildcard certificate for both api.example.com and www.example.com? Are there any inconveniences?

What about those 1-server-only certificates? Because I'm deploying my API in n servers with a load balancer on front.

  • Certificates are tied to their domain names (or in the case of a wildcard, *.domain) - you can deploy the one certificate to dozens of servers without issue. We do this now with a load balancer, you just need to remember to update every certificate on every server when renewal time comes. Jul 16, 2010 at 0:23

2 Answers 2


You are correct, using a wildcard cert is a great idea in this case. It'll keep your configuration for separate domains simple, and ensure that any subdomains you decide to add will work.

There are a couple drawbacks:
- Your top level domain is not secure. As in, the certificate is not good for example.com.
- They are very expensive, normally around $1k.

As for 1-server-only certs, it depends on the agreement you make when you purchase the cert. Some will allow the cert to be installed on multiple servers, some will not. Also, I have no idea how or if they check that the cert is only installed on a single server. You might be able to get away with it...

Also, if you are using a load balancer, I would recommend installing the cert there, if your hardware allows it. I know the Cisco CSS series has a dedicated hardware module that handles all the encryption and decryption, saving some work for your servers.

  • 3
    Digicert wildcard SSL is 1/2 to 1/3 that price and is flexible (multi server installs). We've been using them for a couple years and it has worked out well for us.
    – JasonBirch
    Jul 16, 2010 at 0:14
  • Godaddy.com sells wildcard certs for around $200/year. I've been using them for going on 3 years right now and haven't had a problem with any browsers accepting them. Jul 17, 2010 at 13:17
  • Digicert certificates will also secure the base domain (i.e. no subdomain) which most other providers need you to buy an additional certificate for
    – Gareth
    Feb 24, 2012 at 12:03

The only problem that I've seen with wildcard certs so far is that they don't appear to have any that support EV. This is only really a concern if you want the cool browser chrome saying "hey, this site is offically OK and vertified". If you're only looking for secure transport and don't care about customer purchasing confidence, go the cheap way. Or buy EV for the www server, and wildcard for the API.

  • I'm ok with that, I expect my bank to have an EV, but not me
    – licorna
    Jul 16, 2010 at 23:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.