Not a sys admin here. So please forgive ignorance. I have read the suggested Q/A here:

My question is: How do I get an SSL Certificate from my client,(even if it is created for use with several names), and apply it to my server?

Here is my situation. We have an AWS instance/DB serving a site we built for a client. The site is at: subdomain.ofourdomain.com. We have our own SSL on that. Client has created a c-name pointing to our site/domain name thusly:

subdomain.ofclientsdomain.com - > subdomain.ofourdomain.com

Browser throws warning using their Cname URL.

Client asked if they can send me THEIR Certificate.

I do not know how that would be done. I have never had someone send me their Certificate.

Should I revert back to the Approved solution in the linked Question/solution and tell them to create a certificate with both our domains? If so how does he apply that? Since it is my server? Thanks James

  • This is not really a security question. In short: with modern web servers it is possible to configure multiple certificates on the same IP address and the server will pick the correct one based on the information from the client (SNI) during the TLS handshake. So it is sufficient that your customer provides you with the certificate and the matching private key, i.e. no need to create a certificate with both. But how exactly you then configure this certificate for the customers domain in your specific web server is specific to the web server and apart from that no longer is a security question. Nov 13, 2019 at 20:28
  • Thank you. I'll ask elsewhere on how to receive that certificate and key.
    – james f
    Nov 13, 2019 at 20:30
  • 2
    @jamesf Since you control a web server that is reachable on the public internet by the subdomain, you can generate a valid TLS certificate using Let's Encrypt HTTP-01 challenge. If you can configure your web server to serve files from a special directory on the filesystem on a special path prefix on that domain, just use certbot (Let's Encrypt client software) with certbot certonly --webroot --webroot-path /var/www/html/blah -d subdomain.ofclientsdomain.com to get a certificate and then use it (don't forget to renew). Or if certbot has integration with your web server software, use that.
    – Z.T.
    Nov 13, 2019 at 21:45


Browse other questions tagged .