We are a small startup. One of our products is a B2B web service, accessible through its https://service.example.com
canonical URL.
For testing purposes, that service also runs on different testing/staging/integration environments, such as https://test.service.example.com
, https://integration.service.example.com
, etc.
We also have collaborative tools such as a bug tracker or a wiki. They run also on machines provided by our hosting provider. Their URLs are e.g. https://wiki.example.com
, https://bugs.example.com
.
To keep things simple, we use a single certificate (for example.com
), and have added all the URLs above as Subject Alternative Names to that same certificate. All our servers thus use the same certificate.
Is there any security issue in doing so that we should be aware of? If yes, what would have been the "correct" way of doing things?