We are a small startup. One of our products is a B2B web service, accessible through its
https://service.example.com canonical URL.
For testing purposes, that service also runs on different testing/staging/integration environments, such as
We also have collaborative tools such as a bug tracker or a wiki. They run also on machines provided by our hosting provider. Their URLs are e.g.
To keep things simple, we use a single certificate (for
example.com), and have added all the URLs above as Subject Alternative Names to that same certificate. All our servers thus use the same certificate.
Is there any security issue in doing so that we should be aware of? If yes, what would have been the "correct" way of doing things?