How many SSL certificates do I need?

[RJcreatives]

Hi all,

So first off, I don't usually deal with licensing so this is a little outside my comfort zone.

 

We are looking into buying an SSL certificate but I personally am not sure how the whole process works and so I do not know if we can get away with just buying 1.

 

So onto the question.

 

If we were to purchase 1 SSL for our domain, would this cover out website, VLE, email and also our OWA?

 

As I said this isn't usually my thing so please try to use small words

 

Many thank!

[howartp]

One certificate can cover as many subdomains as you want - but the cost goes up.

 

I use GoDaddy and when I started with SSL about four years ago, I bought a 5-domain certificate for three years. I just used it for http://www.mydomain.org, mail.mydomain.org, and VLE.mydomain.org. I therefore had two spare domains - so three months later I could have added portal.mydomain.org without paying again.

 

If I had only needed http://www.mydomain.org, I could have just bought a single-domain certificate. However I thought I was being very good, future-planning by having spares available.

 

However, a few months later, I wanted to use Exchange, which needed (at the time) another 4-5 domains; so I had to purchase a 15-domain certificate that covered all the previous domains plus the new ones. I then got a refund on the unused portion of the old one (say 24 months).

 

My 15 domain certificate expires in March and I have decided to buy a WILDCARD certificate. These are more expensive, but they cover *.mydomain.com (ie anynamesiwant.mydomain.com) - I'm already using 14 of my domains and I want another 3 already.

 

If you want to cover website, vle and exchange, you will need at least 4 domains; exchange needs autodiscover.yourdomain.com as well as your OWA, and if you have two client access servers running OWA, you will likely want one for each.

 

Peter

[hawc]

I would say go for a wildcard certificate. This would be easier than lots of certificates, however it is a lot more expensive. Namecheap do them for £60: https://www.namecheap.com/security/ssl-certificates/wildcard.aspx

[Arthur]

If you need a wildcard certificate that also covers your domain (without any sub-domains), you may need to look at the Wildcard+SAN certificates that DigiCert sell although these are significantly more expensive.

 

www.digicert.com/ssl-support/wildcard-san-names.htm

 

In general, wildcard certificates can only be used to secure first-level sub-domains of the domain to which they are issued. For example, a standard wildcard certificate is issued to *.domain.com. Once that certificate is installed on the server(s), users can connect securely to http://www.domain.com, mail.domain.com, autodiscover.domain.com, etc.

 

However, because the name on your certificate must exactly match the name that a user is connecting to, a standard wildcard does not allow your users to connect to your domain with no subdomain (domain.com) or with multiple levels of subdomains (multiple.sublevels.domain.com). Additionally, this allows some devices that are not normally compatible with wildcard certificates (see the list here) to work.

 

I don't usually deal with licensing so this is a little outside my comfort zone.

SSL certificates haven't really got anything to do with licensing.

[Arthur]

@RJcreatives. This thread might be of interest? Edited October 12, 2014 by Arthur

[TechMonkey]

If you need a wildcard certificate that also covers your domain (without any sub-domains), you may need to look at the Wildcard+SAN certificates that DigiCert sell although these are significantly more expensive.

 

www.digicert.com/ssl-support/wildcard-san-names.htm

Surely that is a non-issue, or a non-issue for any application I can see a school needing. Normally domain.com is mapped to www & it isn't often that a bogstandard www will be SSL'd. I can't think of any reason you would need SSL for domain.com. Or was it just a general gotcha to be aware of?

 

We are purchasing a wildcard SSL and have used them in previous work places. If you work out how many SSLs you need and how many you could potentially need and work out the cost often a wildcard comes in much cheaper than separates.

[RJcreatives]

Sorry for the really delayed reply. We needed one SSL for our external email access as it is an https site but we now have that all sorted and working fine.

[Arthur]

Or was it just a general gotcha to be aware of?

It was.