What is the optimal way (cost-wise, too) to secure page forms (https) on a large number of domains&subdomains? Are certificates required for all domains? Is putting all the page forms on a single secured domain -and than redirecting frm all sites to this one- a solution?
You need a wildcard certificate with alternate name support. I use one from StartSSL. You have to get a class 2 certificate, so it does have a small cost ($60 for a year of issuing unlimited number of 2 year long certificates) but you can then create a certificate which will cover all sub-domains and domains on your site.
It needs to all be on one certificate if you only have one IP address and then you have to use host header support to identify which site the user is trying to access.
Yes - Security certificates are tied to a domain (even example.com and www.example.com would technically need two certificates or a multiple domain certificate). You can get a wildcard certificate, but I think they are still very expensive and work for one second-level domain.
Yes - I think you should be OK submitting across domains since you (presumably) own both sites. You'll probably want to check the referrer in server-side code to ensure it is coming from a site you intend it do (spam control and security), and it'll give you a place to return the user.
You may run into cross-domain issues, but I think you'll be OK. You should be able to have the form hosted on one site, but it will post data to the secure site.
Credit for this to the answer below from @AJHenderson - Use StartSSL. I had no idea. I upvoted his answer for that reason. I'm now using individual StartSSL certs for SPDY on Nginx on several domains, on one IP. It works on newer browsers, however I don't care much about browsers/OSes that can't handle it due to the content of my sites.
It is possible to obtain a certificate for an IP address rather than a domain name. You could theoretically set your form action to the IP address for processing. With subdomains, you can obtain a wild card cert if they are all under the same subdomain, but there are potential draw backs.
However, you will run into a few issues.
- First and foremost, you are only securing the submission of the form and not the initial load of the form. If the form is not loaded securely then its possible for a man in the middle attack to occur and to change the
<form />'saction attribute or inject other data.
- If you are going across servers, it will be more complicated to implement CSRF tokens since you will need some type of server-to-server communication on the backend.
- You may run into cross domain issues, while not impossible to resolve, it does add some complexity to your role out (see Some Origin Policy, CORS)
If this is just a contact form maybe you setup another site with something generic (contactusforms.com/clientA, contactusforms.com/clientB) and direct them there for those links or for sign-ups, etc. I believe you will still run into problems if you try to put the form into an