1

Provider suggests me two types of SSL certificates: for domain only or for domain and subdomains. First one is cheaper.

Currently I already have certificate for previous year. How to know, if it was bought for domain only or for domain and subdomains?

2
1

When you purchase certificate for single domain, Subject Alternative Names (SAN) extension will typically include two entries:

example.com
www.example.com

this will allow:

  • parent domain
  • www host under parent domain

when you purchase certificate for arbitrary subdomains (without hosts in subdomains), then you can get a wildcard certificate with the following entries:

example.com
*.example.com

this will allow:

  • parent domain
  • any subdomain without hosts (e.g. www.sub.example.com is not covered)
  • any host under parent domain

if you want to have hosts under subdomains, then all subdomains must be listed explicitly, e.g.

example.com
*.example.com
*.sub1.example.com
*.sub2.example.com

this combination will allow:

  • parent domain
  • any subdomain
  • any host under parent domain
  • any host under sub1.example.com domain
  • any host under sub2.example.com domain
1

Use your browser (or other TLS client) to view the certificate after connecting, or just look at the certificate file with a tool that will parse it for you (such as the certificate viewer built into Windows). Look in particular for the "Common Name" and "Subject Alternate Names" (SAN) fields, which will list the domain name(s) for which the certificate is valid. If either one starts with *. - as in, *.yourdomain.com - that indicates that subdomains are supported (typically such certificates will also list the root domain, yourdomain.com, as one of the entries in one of those fields). The * is called a "wildcard", and a cert that uses one in the CN/SAN fields is called a "wildcard certificate". Wildcard certs are sometimes more expensive.

Note that a cert can cover many domains (and/or subdomains of one or more particular domains) explicitly, without using a wildcard. Certs that cover multiple domains are often more expensive, since it's essentially multiple certs in one.


I'd be remiss to not mention: you can get a cert issued without paying anybody at all. LetsEncrypt is a well-known free certificate authority, trusted by all major browsers, and they will not only issue as many certs as you need for free, they provide tools to automate the renewal of these certs (their expiration is short, but automatic renewing is easy on most platforms).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.