1

I have 2 domains, one where the website is hosted (lets call it www.a.com), and another (lets call it www.b.com) which has a CNAME record pointing to the first one (www.a.com). Which one should have a SSL certificate? Should they both?

4
  • You only really need an SSL for the domain hosting the site. There other one I'm assuming will redirect to the secure URL? Apr 18 '16 at 10:24
  • That's what I thought as well, but I have an SSL certificate for the domain which is hosting the site (www.a.com), and when I access www.a.com directly I can use https, but when I use www.b.com I cannot use https. Apr 18 '16 at 10:30
  • @thesecretmaster have you tried to RewriteRule to force HTTPS?
    – Ay0
    Apr 18 '16 at 10:33
  • @yzT From googling, it seems like RewriteRule is for Apache. Thats not what I'm using so I don't know how to implement that. Apr 18 '16 at 10:36
4

Certificate validation is done against the hostname given in the URL, which means you'll need a certificate for any hostname which you expect to be used inside a URL.

Thus, if you want to use both www.a.com and www.b.com in the URL you need a certificate for each, even if they are the same host and if one redirects to the other. DNS settings like same IP address or alias (CNAME) do not matter at all, all that matters is the name given in the URL.

3
  • what would happen if b.com is forced to https://a.com in the web sever?
    – Ay0
    Apr 18 '16 at 10:43
  • @yzT: again: " you'll need a certificate for any hostname which you expect to be used inside a URL". It does not matter what the server does, it only matters that the certificate the browser got matches the hostname exactly as seen in the URL. Apr 18 '16 at 10:54
  • 1
    @yzT Anyone visiting b.com via HTTP would be redirected to a.com, however if they used HTTPS they would receive an error. Apr 18 '16 at 12:03
1

Just to add to the existing answer, if you want to secure multiple domains using a single certificate, you can explore Subject Alternate Name (SAN) certs, which allow you to protect more than one FQDNs. Quoting from the example given in the linked article:

With a Multi-Domain (SAN) Certificate, you can secure:

1) www.example.com

2) www.example2.com

3) www.example3.net

4) mail.example.net

This makes Multi-Domain (SAN) Certificates perfect for any environment where you need to secure multiple names across different domains

From your question it seems like you want your client to be able to connect to both https://www.a.com and https://www.b.com so SAN cert would be one way of doing it.

0

It is clear that the certificate authority will issue certificate for fully qualify domain name and validate your domain name, which you want to use for website address. In that case, if you wish to continue with two domain names (www.a.com and www.b.com), then you have two choices as below.

1. Get individual certificates for each

You can purchase different two individual certificates for each domain. As a result, the certificate cost would be high and management process will become unbearable for you.

2. Single certificate for multiple websites

It is good to go with SAN certificate that is able to secure multiple domains with a single SSL certificate and it is available at reasonable price. SAN also offers simple certificate management, as you have to manage a single certificate. Moreover, you can add other domains anytime if you require.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.