SSL certificates for public web servers

[tfboy]

Hi, I'm trying to figure out the best / most flexible way of renewing a SSL certificate.

Currently, I have one domain with a SSL certificate purchased via GoDaddy and provided via Starfish Tech. This is up for renewal.

I would like to extend the certificate to cover multiple sub-domains.

Looking at GoDaddy's site, I'm confused as they talk about "multipe domains (UCC)" and "single domains with multiple subdomains". The examples shown seem to be identical. Yet the names and prices are different.

So bearing in mind I would like to have:
subone.mydomain.com and subtwo.mydomain.com, what do you suggest? Those two sites are currently hosted on different VPSs, but I might add more VPSs or more subdomains within a given VPS (they're all running Apache on Linux).

Suggestions of solutions or alternative providers welcome.

I could use a self-signed certificate, but I don't want the hassle of people coming back to me saying "it looks insecure, firefox complains", etc. I don't want to have to go to a proper level 2 certificate as it'll be more hassle with the company. All I need is to ensure data is encrypted.

thanks

[Jay]

I think Multi domains is

domain name.com
domain name.co.uk etc

Subdomain

anything.domain.com
anything2.domain.com

multi is good if you have shared hosting with lots of domains on the one box, also good if you have lots of differnt domains on one exchange box.

[tfboy]

Thanks.

In fact, to be precise, under the UCC header, it talks about SAN (Subject Alternative Names) which seems to be the same thing as multiple sub domains.

[badass]

Thanks.

In fact, to be precise, under the UCC header, it talks about SAN (Subject Alternative Names) which seems to be the same thing as multiple sub domains.

They call the certificates UCC because they are popular with Microsoft Exchange Unified Communications.
For the UCC certificate, you will only get one certificate with the SAN field populated with alternative names. e.g. If you connect to www.foo.com, the browser gets the www.foo.com certificate. If you connect to webmail.foo.com, your browser sees the www.foo.com certificate. However the SAN field includes webmail.foo.com so the certificate is accepted.

I believe for the other subdomains certificates, you will get one certificate for each subdomain but I've yet to order one of those so cannot confirm nor deny that.

[tfboy]

Thanks.
With UUC, what happens when you want to add a new subdomain at a later date? Does the updated / reissue of the cert mean that the previous version already installed on the existing servers become invalid? i.e. does an update revoke all previous versions?

[badass]

Thanks.
With UUC, what happens when you want to add a new subdomain at a later date? Does the updated / reissue of the cert mean that the previous version already installed on the existing servers become invalid? i.e. does an update revoke all previous versions?

There is no technical reason for that to happen. With Comodo I have used old certificates that have been superseded and they were not revoked.

I'm not saying others will not revoke updated certificates, though.

One thing that is important in this case:

Make sure your certificate request and renewal process is refined, practised, documented and make sure a reminder flashes up on various calendars for renewal in advance. Certificate renewal is really easy for anyone to do when they follow prepared steps. It takes a lot longer if you don't have the process well documented and tested as you either pick up the pieces after a mistake or double check everything before and after each step.

[tfboy]

Thanks. I did read that you cannot issue a certificate for a domain that already has one. In your case, maybe the re-issue implicitly revoked the previous ones and you didn't have to do it.

It looks like I'll be sticking to a single domain cert anyway, so the wildcard questions are no longer that important

Thanks for answering though

[tfboy]

I guess Zybros' response from this afternoon was soft deleted LOL.

I think I'm fine now: startssl do free ones for a year, and that'll keep me going till next year