Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If you look at the (invalid) certificate for it says only valid for the following names:

The certificate is only valid for the following names and then a list of about 100 names.

Isn't it a danger to have one certificate for multiple domains?

share|improve this question
It's a cert for a cdn, that is a list of all the domains the cdn uses. – ewanm89 Oct 23 '12 at 17:42
To save others some time, a screenshot: (45kb) – Luc Oct 23 '12 at 17:45
I was looking for a provider that supports many SAN names! Exchange 2010 requires several of these, and most CAs have an upper limit of 5 or 10. – LamonteCristo Oct 30 '12 at 23:31

It seems that this certificate works for so many domains because it's part of a CDN. CDNs, or Content Delivery Networks, deliver files which are always the same (or 'static'). The site's logo, some style rules for the website, those things. The page itself may change, for example based on whether you are logged in, but often images (and such) don't change.

Such CDN is used because the closer a server is, the faster the page will load. However, not everybody has the resources to install dozens of servers around the world, so companies like Cloudflare and Akamai offer their CDN space (and a big network which can handle lots of traffic), just like hosting is being sold.

In order to provide all data securely (and avoid mixed-content errors), the certificate used by the CDN's server must be valid for all domains that it hosts files for. It is a risk to be able to spoof that many domains by stealing a single private key (and you only need access to one of the hundreds of servers), but it seems to outweigh the benefits. It seems it are mostly subdomains too (or perhaps only subdomains, I haven't checked).

share|improve this answer
why can't they use a different certificate for each domain name? – jdoe Oct 25 '12 at 15:22
@jdoe Because that requires SNI, and is a rather long story. This answer on Serverfault explained it for me. If that's still not clear, let me know! Edit: And also, from a security perspective, the server would still need to know all those certificates (or at least a number of them). If you can grab one, you can probably grab all private keys stored there. – Luc Oct 25 '12 at 17:17

The certificate belongs to EdgeCast, a CDN.

Their job is to serve content on behalf of other companies. The servers that do this typically handle results for hundreds or thousands of different domains, and they have thousands of servers for this purposes scattered all over the world. There are simply too many domains hosted on these servers to give each its own IP, so if they want to serve CDN files over SSL, they have to share a single SSL certificate.

The marginal benefit of serving CDN-hosted files over SSL is minimal, but it's particularly important if you intend to include those files in an SSL-delivered page. Remember that if your page is SSL, then all of the images, scripts, and other resources must also be delivered over SSL, no matter what domain they come from.

Note that none of the SSL domains are the "primary" domain for the site. Instead they're names like and The companies aren't sharing their own private SSL certificate with all their neighbors; this certificate will not work on or Instead they're turning over control of a single-purpose subdomain to edgecast and allowing edgecast to include all these edgecast-specific subdomains into a single certificate specifically for this purpose.

Whom are you trusting with the key to your site? Edgecast, of course. Yes, other companies are also on the same certificate, but the private key is not controlled by you or by any of them; it's controlled by EdgeCast. You're trusting EdgeCast's infrastructure to not allow any other company's content to be visible on your domain. This is the same degree of trust you always are implictly granting to any company you allow to serve content on your behalf. The certificate doesn't really change that relationship.

share|improve this answer
They aren't sharing their own key, we hope anyway, but if you can inject scripts you own the page. – Luc Oct 23 '12 at 18:42
The IP address issue is important, for those not familiar with Subject Alternative Names... the core of it is that SSL Encryption is set up before the http request, this makes virtual hosting impossible without initially providing a certificate valid for ALL of the domains being served. There are other schemes to handle this, but Subject Alt Names are the most robust for clients at the moment. Hence the 100+ names in the cert. – mgjk Oct 23 '12 at 20:14

Having one certificate for multiple domains creates a single point of failure. However, if an attacker where to obtain the private key then you probably have bigger problems on your hands.

share|improve this answer

They are called UCC/SAN certs. When you want to secure more than one domain, you buy a UCC cert. It is very cost effective compared to purchasing a regular SSL cert. A lot of cert providers use 2048 bit for generating the keys so I don't believe there is any compromise in terms of security.

Here is the link to Wikipedia which compares different certs.

Hope that helps...

share|improve this answer
why does it more cost effective? – jdoe Oct 26 '12 at 13:26

Some companies use certs with SAN names because it makes certificate renewal and management easier. Deploying 1 certificate to 100 websites is easier than deploying 100 certs to 100 websites.

Is it less secure? Yes, it is less secure only in the technical sense. Many times business needs of ease of management preempt conventional security thinking. They may be short staffed and only have enough time to do the bare minimum of security. The counter argument is that they may not do SSL at all if it's too hard (I've seen it happen)

Maybe they don't need the security and are using SSL for the vanity (or assumed security) of a given website. I would be OK downloading images using a certificate with a bloated SAN namespace like that, however I wouldn't want to use any bank or government site listed in such a certificate.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.