I have a customer who has a bunch of websites, such as islandwidgets.com, mainewidgets.com, etc..., but he would like to have them all use secure.widgets.com when using https. Is something like this possible? They would all be using the same IIS website, so I can handle it on the server side if need be, but I really don't have much experience dealing with this type of issue. Thanks.

  • I'm not sure that I follow; why would it not be possible? In what way are you using secure.widgets.com? – DocRoot Jun 23 '16 at 15:14
  • The customer only wants to use one url to host the secure portion of these different sites, for things like checkout and managing a user's account. The issue I am having is that these users will come from different sites, with things such as the shopping cart, that will need to continue to work, even though the domain is now secure.widgets.com, not islandwidgets.com. Hopefully this helps. – Wade73 Jun 23 '16 at 15:18
  • Ah I see. That seems a bit weird... isn't it usually preferable to keep it all under the one domain if you have the ability to do so? Using secure.widgets.com looks (to the user) like a 3rd party service (that you would need to use if you didn't have the ability to host it all yourself)? Like any other 3rd party service you could perhaps implement this by sending secure messages between the domains, or perhaps (since they are all on the same server) implement some kind of shared session management? (Just thinking aloud.) – DocRoot Jun 23 '16 at 16:49
  • @DocRoot He is trying to save the cost of getting a SSL cert for a bunch of similar sites, which have different looks, but share the same product in the end. So while I think it is weird as well, I see the desire to reduce cost. – Wade73 Jun 23 '16 at 17:36

The first thing to bare in mind is that a wildcard SSL certificate is only marginally more expensive than a standard certificate, and a wildcard certificate would resolve the issues cleanly.

If a single secure domain is required (assuming https://secure.example.com) then what you would need to do is ensure that shopping cart data is stored in the database and when the user goes to the checkout (secure site) some unique one time key is passed along with it to identify the cart in question and recall the products being sold to be processed through the checkout.

  • Wildcard certificates only cover subdomains. What they would actually need is a multi-domain UCC certificate. Other than that terminology, your answer is very good. I get my UCC certificate through StartSSL. I pay a flat fee (like $60) and can add as many domains as I need. – Stephen Ostermiller Oct 24 '16 at 12:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.