Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
While browsing for SSL certificates, specifically domain validation type (the cheapest), I noticed that they advertise as valid for a single domain/subdomain, but then I noticed that they are valid for a single subdomain along with the root domain.
One of the certificates advertise as Secures 'www' & 'non-www'.
Is that common for domain level validation certificates ?, and should I expect all domain level validation certificates to be able to secure the root domain and a single subdomain ?
I have seen it too -- my own server uses such a certificate, with two names in it: example.com and www.example.com.
The notion of "domain certificate" is not technical; it is a marketing term. From the technical point of view, an X.509 certificate contains a Subject Alt Name extension which may contain zero, one, two... or really many names of type dNSName. It is up to each CA to decide what it sells and at which price.
Keep in mind that at one time the SubjectAltName was not widely supported, but is now fairly common. However, DigiCert as well as some other certificate authorities still keep a client compatibility list available, e.g.: DigiCert - Subject Alternative Names: Compatibility
If you're ever concerned about it, just spring for the extra cash and get what is known as a wildcard certificate. Your common name becomes *.primarydomain.com, and then redirect from https://primarydomain.com to https://www.primarydomain.com.
