Welcome to the staging ground for new communities! Each proposal has a description in the "Descriptions" category and a body of questions and answers in "Incubator Q&A". You can ask questions (and get answers, we hope!) right away, and start new proposals.
One cert with many domains, or one domain per cert? Question
I've noticed that it's possible to use DNS Name multiple times, so that a TLS certificate will cover multiple domains.
Alternatively, you could generate a separate cert for each domain.
What are the implications of choosing one approach or the other, in terms of security and maintainability?
I'm sure actual certificate agencies restrict such things, and of course more certificates can be more expensive (unless you use a free CA like LetsEncrypt). In this case, I am asking about self-signed certificates for my own internal servers. So let's disregard purely administrative restrictions, and look at the practical consequences.
1 answer
The following users marked this post as Works for me:
| User | Comment | Date |
|---|---|---|
| matthewsnyder | (no comment) | Mar 29, 2024 at 16:31 |
Relevant to you
- A single certificate is easier to manage, rotate, etc.
Borderline
-
Before Server Name Indication (SNI), you could only bind one certificate to each IP/Port combination on a particular server. SNI had to be supported both on the server and on the client. If you have IE8 users visiting your web server for some reason, you'd need to use a single certificate.
-
If you add more domains later, separate certificates are cheaper because you don't have to re-request a CSR for an old- and new-domain cert before the normal expiration/renewal of your old one. The monetary cost isn't a factor for you, but it's up to you whether it's easiest to add a new site with its own cert or to rebind everyone.
Not relevant to you
-
Multiple domains on a single certificate are expensive, just like multiple certificates are expensive. And wildcards cost more, too. You'd have to look up the pricing structure of your particular CA to price out the most affordable CSR scheme.
-
With several sites on the same cert, it might be weird for one site to be associated with the domain of the other. This is pretty unremarkable, though. Someone could still determine that they were both on the same IP.
0 comment threads
0 comment threads