1

In order to provide https-enabled access to several (e.g. around 5) subdomains and several top level domains on different IPs.

Which of the following approaches is technically feasible?

  1. a one-use SSL certificate for each subdomain and domain
  2. a multi-domain certificate
  3. a mixture of wildcard and single domain
  4. a mixture of wildcard and multi-domain certificates?

closed as unclear what you're asking by Xander, Matthew, Neil Smithline, Dog eat cat world, LvB Mar 31 '16 at 11:01

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    I'm not sure what you mean by "feasible/straightforward" in terms of security. There is certainly a big different in costs, but cost considerations are off-topic here. Logistical considerations as a server admin are better asked on Serverfault or Webmasters. – schroeder Mar 30 '16 at 15:42
  • Is it technically possible to implement with all of the options described, or do only some of them apply, do you know? – Anthony Mar 30 '16 at 15:58
2

All of these approaches are technically feasible, i.e. they can be generated and browsers will accept these. But while you can create such certificates using your own CA it does not mean that every CA will support issuing all of these variations.

In case of using a single certificate for each different name you have to make sure that either each of these names points to a different IP address or that your server and client both support Server Name Indication (SNI). While this is true for all modern browsers and web servers you might get problems with older browser or applications or with protocols outside HTTP.

  • 2
    One policy constraint: if you want EV -- and whether you should want EV is a different question -- CABforum prohibits wildcards in EV certs. – dave_thompson_085 Mar 31 '16 at 5:33

Not the answer you're looking for? Browse other questions tagged or ask your own question.