Modifying SSL Certificate once created, Multi domain

Question

We're developing an application that has the ability to run across multiple top level domains, each with its own sub domain. (www.foo.com, www.bar.com, would each point to the same application on the same server, mobile sub domains pointing to a different application on the same server.)

Reading up on certificate creation for multiple domains leads me to believe that it is possible to do so, having one certificate that would govern each of the domains that are listed during setup.

However, if we were required to add extra domains to that certificate after its creation, would this be possible? Either through some kind of renewal type process? Or editing and reapplying the certificate?

Answer 1

Certificates cannot be edited; they are signed and the signature becomes invalid if you changes the slightest bit in them (literally: there is not a single bit that you can flip without breaking the signature). If you want to "modify" a certificate, then you actually want to obtain a new certificate, with contents that please you more.

Certificates are obtained from a Certification Authority. Since commercial CA make money by selling certificates, I am quite sure that your CA will be thrilled to sell you another one.

Answer 2

(usually) you can concat multiple certificates into one file (means: adding more certs later), but this solution would require server and client to be able to use SNI

Answer 3

At a technical level certificates cannot be modified, a new one must be issued.

What if anything to charge for that is down to the individual CA. Many CAs will allow a free "reissue" to add names. https://www.namecheap.com/support/knowledgebase/article.aspx/9282/2221/can-i-add-another-domain-later-after-the-ssl-certificate-has-been-issued-and-activated