What websites (URLs) can be protected by one SSL certificate?
For example, www.security.hsbc.co.uk has a SSL certificate. Can this certificate be used to protect other websites (URLs)? Something that branches off from this one maybe?
If you view the certificate in your web browser, you should be able to find the
certificate subject alternative name value for the certificate. This will show a list of all of the sites that can be secured using this certificate, in addition to the site shown in the
common name for the certificate. You may see wildcard values used in some of the names, such as *.hsbc.co.uk or *.security.hsbc.co.uk.
As an example, if you look at the certificate protecting this page, you'll see that Stack Exchange uses one certificate for all their sites:
The site we're currently on,
https://security.stackexchange.com is covered by the wildcard SAN
Bear in mind that in order for any site listed in these fields to use this certificate, the site would need the private key that corresponds to the public key in the certificate.
These conditions must be met in order for your browser to make a SSL/TLS connection to the site, without warnings.
For a site to successfully use any given X.509 certificate (the type of certificate used by TLS/SSL), it has to meet a few specific requirements:
Any website that meets all four requirements for the certificate can use that certificate. Some browsers may warn the user instead of blocking access to the site if any of the above requirements other than the first aren't met, though this is becoming less and less common as a result of HSTS becoming the norm (if a site has asked for HSTS, the browser should block all access without a certificate that doesn't meet all four requirements).