2

We have a case where we are currently using *.yourdomain.com (wildcard certificate) and due to some reason we need another certificate (Multi-domain UCC certificate) for subdomain.yourdomain.com.

On a few of our systems the *.yourdomain.com will remain active whereas on the rest of our systems we'll be using the new UCC certificate subdomain.yourdomain.com.

Can two of these certs co-exist for a single domain and not cause clash?

Regards, Uzair

  • What server software are you using? – StackzOfZtuff Mar 16 '15 at 10:41
  • @StackzOfZtuff We use multiple OSs in our infrastructure. Some are Windows, some CentOS etc.. a few are being used with web servers (Nginx, Apache etc) and a few are being used for VPN tunnels (IPSec, IKEv2, SSTP etc) – user3775042 Mar 16 '15 at 11:12
2

Can two of these certs co-exist for a single domain and not cause clash?

As long as both certificates are valid and match the hostname it should be no problem from the client side.

0

On both the server and client side there must be support for SNI (Server Name Indication) in order to serve two different certificates for one domain/IP. SNI allows the client to specify the hostname when making a request, and thus have the server provided the correct certificate.

Notably, on the client side, no versions of IE on XP support SNI. On the server side, I dont think its available on any versions before Windows Server 2012 (IIS 8).

Source: http://blogs.msdn.com/b/kaushal/archive/2012/09/04/server-name-indication-sni-in-iis-8-windows-server-2012.aspx

https://support.cloudflare.com/hc/en-us/articles/203274000-Does-CloudFlare-s-free-Universal-SSL-have-limitations-

Edit: Some SSL providers, such as Comodo, sell a "Multi-Domain Wildcard" which combines the functions of both certificates (by allowing a wildcard character [*] as a SAN). This could be an alternate solution as then you could serve one certificate without worrying about the hostname.

0

Yes definitely you can use two different SSL certificates for single domain.

You have to use wildcard SSL certificate for the rest of sub domains and then configure multi domain UCC certificate for the particular domain for which you don't want wildcard Certificate.

You must understand how wildcard SSL Certificate works..

Once you install wildcard SSL on your server it doesnt mean that it will automatically secure your all *.domainname.com sub-domains, you need to configure it individually for each sub-domain you wish to secure.

As you wish to install Multi Domain UCC for one sub-domains, for that you simply skip that domain from configuring with wildcard SSL certificate.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.