I've looked on for an answer on google and other forums for this question but couldn't get a solution or a hint for the scenario that I have.

I've a domain, say abc.com, which is live with ssl on wpengine. Now we need to show a third party login form on our own subdomain, you can read the 3rd party requirement for this setup here.

Now, say I need to show that 3rd party login on my own subdomain according to their steps on portal.abc.com, and the main requirement of that third party is that the subdomain must have ssl(for which we need to provide them files also) and the subdomain must then cname there domain.

The thing I can't figure out yet is how the ssl will be applied to the cname only subdomain?

Any hints or suggestions are highly appreciated.

  • 1
    Hello. I do not believe this question belongs on security.stackexchange. Please try serverfault.com or webmasters.stackexchange.com
    – ahron
    Commented Apr 26, 2019 at 7:53
  • Hello there, sure i'll add it there also, but as the main thing i require here was the ssl so thought this is the right forum, but the cname is also part of it so kind of mix question. Commented Apr 26, 2019 at 7:58
  • If the question was about a fundamental problem with the inner workings of ssl, or a potential exploit/flaw/etc. in the design of ssl, this would be the right forum. As I understand, you need some advice on how to set up ssl for your specific use-case - that's for the webmasters and server admins :-)
    – ahron
    Commented Apr 26, 2019 at 8:06

1 Answer 1


For the certificate it does not matter if it is a CNAME or a direct (A or AAAA) DNS record, all what matters is the domain as shown in the URL. The certificate must include this domain as subject or subject alternative name, it is irrelevant if this behind the scenes points via CNAME to some other domain.

From your description I assume that abc.example is your domain. And the third party wants to provide its own content under the sub-domain portal.abc.example, served from their own servers. To provide HTTPS for this the third party would need to have a certificate for portal.abc.example and also own the private key for this certificate. This could be achieved by making portal.abc.example a DNS CNAME for third-party.example. When this is done the third party could prove that it has full control over the content of portal.abc.example and could thus get a DV (domain validated) certificate for this domain.

Not the answer you're looking for? Browse other questions tagged .