Edit: Would deleting the www.hungry.example.org DNS record be a good solution if there are no links to it?

I have a domain (example.org) and a subdomain (hungry.example.org). Until recently they had separate SSL Certificates and everything was nice and peachy.

We moved to Sucuri recently and they requested to replace these 2 certs with 1 wildcard certificate in order for the subdomain traffic to go through the firewall.

Our cPanel has the Let's Encrypt Plugin which I used to generate a cert that covers *.example.org. It covers hungry.example.org, www.example.org, and example.org. Unfortunately; however, it does not cover www.hungry.example.org and users that navigate there will get a browser ssl misconfiguration error.

Things I've tried so far:

  1. Setting www.hungry.example.org as a CNAME to hungry.example.org

    Didn't work, still getting ssl misconfiguration error when going to www.hungry.example.org

  2. Doing an .htaccess redirect from www.hungry.example.org to hungry.example.org

    Didn't work, still getting ssl misconfiguration error when going to www.hungry.example.org

  3. I've thought about issuing a separate certificate for www.hungry.example.org to avoid the error, and then using one of the above methods to redirect all traffic to non-www and thus go through Sucuri. However, the Let's Encrypt plugin doesn't allow issuing a certificate for only www.hungry.example.org. It would also need to cover hungry.example.org which is already covered by the wildcard cert - and I'm worried that having two certs cover hungry.example.org isn't a good configuration idea.

Any tips?


Just specify Subject Alternative Name (SAN) as www.hungry.example.org in your main wildcard certificate.

  • Doesn't seem like there's a way to do this via the Let's Encrypt plugin unfortunately. I could generate the Let's Encrypt cert manually and set up a way to automatically renew it though. Just wondering if there's any quicker solutions - otherwise this definitely looks like the way to go – user1114 Dec 25 '18 at 17:21
  • There is a way: community.letsencrypt.org/t/how-to-create-a-san-cert/30446/3 – odo Dec 25 '18 at 17:24
  • @user1114: any forms of redirect or CNAME will not work - only having this as additional SAN will work. – Steffen Ullrich Dec 25 '18 at 17:39
  • I have access to the plugin via UI, but I don't have root access to the box which seems necessary to use the plugin CLI to add a SAN per the link. – user1114 Dec 25 '18 at 17:49
  • Is there any way to add a SAN via the Let's Encrypt UI plugin (or via any other methods that are authorized with normal cpanel access?) – user1114 Dec 25 '18 at 17:58

Not the answer you're looking for? Browse other questions tagged or ask your own question.