SSL certificates for Sub-Domains (https web services on multiple servers)

[Davit2005]

We have subdomains pointing to different servers but we were looking at just buying a single certificate with wildcards.

 

All servers are going to be on our own site but a few may be outside of our main production network for security i.e in a DMZ.

[Achandler]

A wildcard will be fine then. We use them for our school website.

[Ergo]

It is possible for any educational establishment to get free certificates which work with most web services - we have recommended and used them with many customers.

 

Have a look at certs.ipsca.com if you want a free wildcard certificate select the free educational cert and use *.domainname.tld as the common name.

 

Regards,

 

David

[Achandler]

Personally I would recommend buying one over ipsca, they see quite slow at making sure all browsers always support them. For example we had an SSL from them that you couldn't use on IE for about 6 months (well ti gave an error) because they missed the deadline to get included in the certificate pack.

[pritchardavid]

Agreed with a paid one, we need to buy one as well, were having a lot of problems with ipsca wildcard. Don't know what ssl company to go with through!

[soveryapt]

Can I just point out (spanner / works / etc) SSL Certificates are linked to IP addresses, so if you get a Wildcard one, it will then only be able to use a certain IP address, so use on multiple servers will throw up errors, if it lets you install it at all. You basically need a different SSL for each IP address you want protecting, so if you have a number of subdomains on one IP address then a wildcard one will work ok (takes a bit of getting your head around some of the setups, but as you will have top level access, it will be a lot easier than I've had on my own webserver .. lol).

[penfold_99]

Can I just point out (spanner / works / etc) SSL Certificates are linked to IP addresses, so if you get a Wildcard one, it will then only be able to use a certain IP address, so use on multiple servers will throw up errors, if it lets you install it at all. You basically need a different SSL for each IP address you want protecting, so if you have a number of subdomains on one IP address then a wildcard one will work ok (takes a bit of getting your head around some of the setups, but as you will have top level access, it will be a lot easier than I've had on my own webserver .. lol).

 

Not all SSL certificate are linked to an IP address. The Certificate authority we deal with allows wildcard certificate to used on unlimited servers.

[soveryapt]

Not all SSL certificate are linked to an IP address. The Certificate authority we deal with allows wildcard certificate to used on unlimited servers.

 

They will be generating a "new" wildcard certificate for each of the servers, or certainly setting up a new authentication. A single SSL certificate bought would only allow one IP address to be used. Yes, you can buy further ones for the same domain, even further wildcard ones, but an SSL is tied to an IP address - or at least this is my understanding and knowledge from the various amounts of Googling I've done on this. .. else SSL would be useless in the protection for spoofed addresses and such ..

 

So, for instance, if I grew my hosting business to having multiple dedicated servers (I wish .. but you know, it's an example) then I could have a wildcard certificate for each of those servers of *.mydomain.com but there would be a different one for each of the IP addresses x.x.x.1 x.x.x.2 x.x.x.3 etc. The one for x.x.x.1 wouldn't secure the others, and visa versa.

 

I was just wanting to point out don't go out buying a single wildcard SSL and expect that you can cover multiple servers. You can get a wildcard SSL for under £100 these days, less if you're not too bothered re insurances and guarantees etc, but for a multi-server environment it's more like £500+ per year for the cheapest option I've found, often with additional costs per extra server, but some do offer unlimited server ability, and if you want EV enhancements, then it's even more.

 

Edited September 7, 2012 by soveryapt