Let's Encrypt and EV certificates for different hosts in the same domainIs it technically possible to...
Can I announce prefix 161.117.25.0/24 even though I don't have all of /24 IPs?
Why avoid shared user accounts?
What is the difference between rolling more dice versus fewer dice?
Do authors have to be politically correct in article-writing?
General past possibility with 'could'
How does Leonard in "Memento" remember reading and writing?
When do I have to declare that I want to twin my spell?
Early credit roll before the end of the film
What is a good reason for every spaceship to carry a weapon on board?
Is it a fallacy if someone claims they need an explanation for every word of your argument to the point where they don't understand common terms?
How do I append a character to the end of every line in an Excel cell?
Square Root Distance from Integers
Variable is not visible
Why are the books in the Game of Thrones citadel library shelved spine inwards?
Has Britain negotiated with any other countries outside the EU in preparation for the exit?
Alien invasion to probe us, why?
New package vs new version?
How can I play a serial killer in a party of good PCs?
"on its way" vs. "in its way"
Why is Agricola named as such?
What happens when a creature with flying blocks my non-flying attacker?
Salsa20 Implementation: Sum of 2 Words with Carries Suppressed
Why does photorec keep finding files after I have filled the disk free space as root?
What to look for when criticizing poetry?
Let's Encrypt and EV certificates for different hosts in the same domain
Is it technically possible to configure two different SSL certificates for the same domain?Let's Encrypt for intranet websites?How to get a certificate from Let's Encrypt for the server which doesn't allows file creation“SSL: CERTIFICATE_VERIFY_FAILED” with my own certificatesWhy are Let's Encrypt certificates accepted by default by browsers?Why can't Let's Encrypt support wildcard certificates?SSL cert securing an on-premises web service where the domain is hosted externallyHow to detect if X.509 certificate belongs to CA or regular end user (host)Port bound TLS certificates? (1 Self-signed & 1 CA)what is the maximum life-time for Let's Encrypt certificates
I have an e-commerce site host name (example.com) and want to install an Extended Validation TLS certificate for it.
But I use a cookieless static content served from another host name (static.example.com) for images of the website.
To be "Google Shopping friendly" and for secure e-commerce reasons, can I use Let's Encrypt or other domain-validated TLS certificates for static.example.com and EV certificates for example.com?
I have gone through this kind of question online but those were was similar to my situation.
tls letsencrypt
edited 3 hours ago
a CVn
6,47812245
asked 13 hours ago
overeroverer
211
New contributor
overer is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
I have an e-commerce site host name (example.com) and want to install an Extended Validation TLS certificate for it.
But I use a cookieless static content served from another host name (static.example.com) for images of the website.
To be "Google Shopping friendly" and for secure e-commerce reasons, can I use Let's Encrypt or other domain-validated TLS certificates for static.example.com and EV certificates for example.com?
I have gone through this kind of question online but those were was similar to my situation.
tls letsencrypt
edited 3 hours ago
a CVn
6,47812245
asked 13 hours ago
overeroverer
211
New contributor
overer is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
I don't think the browser cares to displays a green bar for assets (images, css, javascript) so yes, you probably can.
– Salman A
2 hours ago
add a comment |
I have an e-commerce site host name (example.com) and want to install an Extended Validation TLS certificate for it.
But I use a cookieless static content served from another host name (static.example.com) for images of the website.
To be "Google Shopping friendly" and for secure e-commerce reasons, can I use Let's Encrypt or other domain-validated TLS certificates for static.example.com and EV certificates for example.com?
I have gone through this kind of question online but those were was similar to my situation.
tls letsencrypt
edited 3 hours ago
a CVn
6,47812245
asked 13 hours ago
overeroverer
211
New contributor
overer is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
I have an e-commerce site host name (example.com) and want to install an Extended Validation TLS certificate for it.
But I use a cookieless static content served from another host name (static.example.com) for images of the website.
To be "Google Shopping friendly" and for secure e-commerce reasons, can I use Let's Encrypt or other domain-validated TLS certificates for static.example.com and EV certificates for example.com?
I have gone through this kind of question online but those were was similar to my situation.
tls letsencrypt
tls letsencrypt
edited 3 hours ago
a CVn
6,47812245
asked 13 hours ago
overeroverer
211
New contributor
overer is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
edited 3 hours ago
a CVn
6,47812245
asked 13 hours ago
overeroverer
211
New contributor
overer is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
edited 3 hours ago
a CVn
6,47812245
edited 3 hours ago
a CVn
6,47812245
edited 3 hours ago
a CVn
6,47812245
6,47812245
asked 13 hours ago
overeroverer
211
New contributor
overer is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 13 hours ago
overeroverer
211
asked 13 hours ago
overeroverer
211
211
New contributor
overer is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
overer is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
overer is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
I don't think the browser cares to displays a green bar for assets (images, css, javascript) so yes, you probably can.
– Salman A
2 hours ago
add a comment |
I don't think the browser cares to displays a green bar for assets (images, css, javascript) so yes, you probably can.
– Salman A
2 hours ago
I don't think the browser cares to displays a green bar for assets (images, css, javascript) so yes, you probably can.
– Salman A
2 hours ago
I don't think the browser cares to displays a green bar for assets (images, css, javascript) so yes, you probably can.
– Salman A
2 hours ago
add a comment |
3 Answers
3
active
oldest
votes
It is possible to have multiple certificates from different vendors for different parts of the domain and even have overlapping certificates., i.e. multiple certificates which could be used to authenticate the same domain.
Browsers actually only care that a specific certificate is valid for the specific domain it is used on and don't care if the same certificate could also be used for other domains. They also only care that all content is served over HTTPS (i.e. no mixed content) but don't care if some content is served with a EV certificate while other content is served with DV certificate only.
Apart from that, I recommend to read Extended Validation Certificates are Dead to get a better opinion if EV certificates are worth their money at all.
answered 10 hours ago
Steffen UllrichSteffen Ullrich
117k13204271
1
Very good link to Troy Hunt's article, worth the read.
– WoJ
7 hours ago
1
Overlapping certificates can actually be a problem for this particular case. If OP passess the key for static.example.com to a CDN but maintain example.com in their own control, then the CDN operator and an attacker who breached CDN operator's security will be able to snoop/impersonate example.com. Note that to actually prevent breaches of trust like this completely, you'll also need to use subresource integrity to prevent your CDN from modifying and injecting scripts into your pages.
– Lie Ryan
6 hours ago
Troy Hunt's extended blog post on EV certificates. A bit less of examples would have been more than enough. Still, it's so entertaining that it's hard to stop reading it.
– Esa Jokinen
4 hours ago
add a comment |
Yes you can, with some caveats.
Normally, letsencrypt certificate are valid for a single FQDN. So you can create an domain-identified only (DV) certificate for static.example.com and an EV-identified certificate for your root domain.
Note be careful that another consideration applies when using wildcard certificate and some multi domain certificate. Some CAs (including LetsEncrypt) may issue a wildcard that will also be valid for the root domain because the CA may automatically add the root to the SAN (subject alternative name) even if you don't explicitly list your root domain when requesting the certificate (the CA can do this since wildcard certificate verification method requires that you demonstrate control/ownership of the domain's DNS). Check the SAN field of the certificate to be sure that your certificate are covering exactly what you expected and no more.
A couple security notes though, be careful of server settings that may apply to all subdomains, like certain Cookies and HSTS config.
answered 12 hours ago
Lie RyanLie Ryan
23.4k34977
2
Multidomain and wildcard are quite different things; LE does the first semiautomatically but not the second. Even if an LE cert does mistakenly include the bare domain, it's perfectly valid to not use that cert for that domain, as long as you can configure your webserver(s?) to do so.
– dave_thompson_085
10 hours ago
@dave_thompson_085: I've updated the answer to be more precise with the wordings.
– Lie Ryan
4 hours ago
add a comment |
There are three options for this situation:
- Go with wildcard ssl certificate to secure your root and its sub domains because it remains easy for you because through option you will have to manage only one certificate for both root and its sub domain that helps to save your time & money.
- If want EV SSL for root domain example.com and also want to secure sub domain static.example.com then go for Symantec EV SSL which now gives facility to secure multi domain with it. (Usually remains high in the price).
- If want EV SSL for root domain example.com and also want to secure sub domain static.example.com then other affordable option is EV Multi Domain SSL because it helps you to get ev ssl for your all multiple domains (which you will include in SAN category). Means your both both root as well as sub domain will be secured with EV SSL.
answered 5 hours ago
DanaDana
113
Your answer is a little short: you mention a few options as bullet points, but not what pros and cons are for each option. The answer also contains some typos. It's a good start for a useful answer, but to get more upvotes, you might want to expand the answer.
– Luc
4 hours ago
Thank you for keeping my attention to that.
– Dana
3 hours ago
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "162"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
overer is a new contributor. Be nice, and check out our Code of Conduct.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f204359%2flets-encrypt-and-ev-certificates-for-different-hosts-in-the-same-domain%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
3 Answers
3
active
oldest
votes
3 Answers
3
active
oldest
votes
active
oldest
votes
active
oldest
votes
It is possible to have multiple certificates from different vendors for different parts of the domain and even have overlapping certificates., i.e. multiple certificates which could be used to authenticate the same domain.
Browsers actually only care that a specific certificate is valid for the specific domain it is used on and don't care if the same certificate could also be used for other domains. They also only care that all content is served over HTTPS (i.e. no mixed content) but don't care if some content is served with a EV certificate while other content is served with DV certificate only.
Apart from that, I recommend to read Extended Validation Certificates are Dead to get a better opinion if EV certificates are worth their money at all.
answered 10 hours ago
Steffen UllrichSteffen Ullrich
117k13204271
1
Very good link to Troy Hunt's article, worth the read.
– WoJ
7 hours ago
1
Overlapping certificates can actually be a problem for this particular case. If OP passess the key for static.example.com to a CDN but maintain example.com in their own control, then the CDN operator and an attacker who breached CDN operator's security will be able to snoop/impersonate example.com. Note that to actually prevent breaches of trust like this completely, you'll also need to use subresource integrity to prevent your CDN from modifying and injecting scripts into your pages.
– Lie Ryan
6 hours ago
Troy Hunt's extended blog post on EV certificates. A bit less of examples would have been more than enough. Still, it's so entertaining that it's hard to stop reading it.
– Esa Jokinen
4 hours ago
add a comment |
It is possible to have multiple certificates from different vendors for different parts of the domain and even have overlapping certificates., i.e. multiple certificates which could be used to authenticate the same domain.
Browsers actually only care that a specific certificate is valid for the specific domain it is used on and don't care if the same certificate could also be used for other domains. They also only care that all content is served over HTTPS (i.e. no mixed content) but don't care if some content is served with a EV certificate while other content is served with DV certificate only.
Apart from that, I recommend to read Extended Validation Certificates are Dead to get a better opinion if EV certificates are worth their money at all.
answered 10 hours ago
Steffen UllrichSteffen Ullrich
117k13204271
1
Very good link to Troy Hunt's article, worth the read.
– WoJ
7 hours ago
1
Overlapping certificates can actually be a problem for this particular case. If OP passess the key for static.example.com to a CDN but maintain example.com in their own control, then the CDN operator and an attacker who breached CDN operator's security will be able to snoop/impersonate example.com. Note that to actually prevent breaches of trust like this completely, you'll also need to use subresource integrity to prevent your CDN from modifying and injecting scripts into your pages.
– Lie Ryan
6 hours ago
Troy Hunt's extended blog post on EV certificates. A bit less of examples would have been more than enough. Still, it's so entertaining that it's hard to stop reading it.
– Esa Jokinen
4 hours ago
add a comment |
It is possible to have multiple certificates from different vendors for different parts of the domain and even have overlapping certificates., i.e. multiple certificates which could be used to authenticate the same domain.
Browsers actually only care that a specific certificate is valid for the specific domain it is used on and don't care if the same certificate could also be used for other domains. They also only care that all content is served over HTTPS (i.e. no mixed content) but don't care if some content is served with a EV certificate while other content is served with DV certificate only.
Apart from that, I recommend to read Extended Validation Certificates are Dead to get a better opinion if EV certificates are worth their money at all.
answered 10 hours ago
Steffen UllrichSteffen Ullrich
117k13204271
It is possible to have multiple certificates from different vendors for different parts of the domain and even have overlapping certificates., i.e. multiple certificates which could be used to authenticate the same domain.
Browsers actually only care that a specific certificate is valid for the specific domain it is used on and don't care if the same certificate could also be used for other domains. They also only care that all content is served over HTTPS (i.e. no mixed content) but don't care if some content is served with a EV certificate while other content is served with DV certificate only.
Apart from that, I recommend to read Extended Validation Certificates are Dead to get a better opinion if EV certificates are worth their money at all.
answered 10 hours ago
Steffen UllrichSteffen Ullrich
117k13204271
answered 10 hours ago
Steffen UllrichSteffen Ullrich
117k13204271
answered 10 hours ago
Steffen UllrichSteffen Ullrich
117k13204271
answered 10 hours ago
Steffen UllrichSteffen Ullrich
117k13204271
117k13204271
1
Very good link to Troy Hunt's article, worth the read.
– WoJ
7 hours ago
1
Overlapping certificates can actually be a problem for this particular case. If OP passess the key for static.example.com to a CDN but maintain example.com in their own control, then the CDN operator and an attacker who breached CDN operator's security will be able to snoop/impersonate example.com. Note that to actually prevent breaches of trust like this completely, you'll also need to use subresource integrity to prevent your CDN from modifying and injecting scripts into your pages.
– Lie Ryan
6 hours ago
Troy Hunt's extended blog post on EV certificates. A bit less of examples would have been more than enough. Still, it's so entertaining that it's hard to stop reading it.
– Esa Jokinen
4 hours ago
add a comment |
1
Very good link to Troy Hunt's article, worth the read.
– WoJ
7 hours ago
1
Overlapping certificates can actually be a problem for this particular case. If OP passess the key for static.example.com to a CDN but maintain example.com in their own control, then the CDN operator and an attacker who breached CDN operator's security will be able to snoop/impersonate example.com. Note that to actually prevent breaches of trust like this completely, you'll also need to use subresource integrity to prevent your CDN from modifying and injecting scripts into your pages.
– Lie Ryan
6 hours ago
Troy Hunt's extended blog post on EV certificates. A bit less of examples would have been more than enough. Still, it's so entertaining that it's hard to stop reading it.
– Esa Jokinen
4 hours ago
1
1
Very good link to Troy Hunt's article, worth the read.
– WoJ
7 hours ago
Very good link to Troy Hunt's article, worth the read.
– WoJ
7 hours ago
1
1
Overlapping certificates can actually be a problem for this particular case. If OP passess the key for static.example.com to a CDN but maintain example.com in their own control, then the CDN operator and an attacker who breached CDN operator's security will be able to snoop/impersonate example.com. Note that to actually prevent breaches of trust like this completely, you'll also need to use subresource integrity to prevent your CDN from modifying and injecting scripts into your pages.
– Lie Ryan
6 hours ago
Overlapping certificates can actually be a problem for this particular case. If OP passess the key for static.example.com to a CDN but maintain example.com in their own control, then the CDN operator and an attacker who breached CDN operator's security will be able to snoop/impersonate example.com. Note that to actually prevent breaches of trust like this completely, you'll also need to use subresource integrity to prevent your CDN from modifying and injecting scripts into your pages.
– Lie Ryan
6 hours ago
Troy Hunt's extended blog post on EV certificates. A bit less of examples would have been more than enough. Still, it's so entertaining that it's hard to stop reading it.
– Esa Jokinen
4 hours ago
Troy Hunt's extended blog post on EV certificates. A bit less of examples would have been more than enough. Still, it's so entertaining that it's hard to stop reading it.
– Esa Jokinen
4 hours ago
add a comment |
Yes you can, with some caveats.
Normally, letsencrypt certificate are valid for a single FQDN. So you can create an domain-identified only (DV) certificate for static.example.com and an EV-identified certificate for your root domain.
Note be careful that another consideration applies when using wildcard certificate and some multi domain certificate. Some CAs (including LetsEncrypt) may issue a wildcard that will also be valid for the root domain because the CA may automatically add the root to the SAN (subject alternative name) even if you don't explicitly list your root domain when requesting the certificate (the CA can do this since wildcard certificate verification method requires that you demonstrate control/ownership of the domain's DNS). Check the SAN field of the certificate to be sure that your certificate are covering exactly what you expected and no more.
A couple security notes though, be careful of server settings that may apply to all subdomains, like certain Cookies and HSTS config.
answered 12 hours ago
Lie RyanLie Ryan
23.4k34977
2
Multidomain and wildcard are quite different things; LE does the first semiautomatically but not the second. Even if an LE cert does mistakenly include the bare domain, it's perfectly valid to not use that cert for that domain, as long as you can configure your webserver(s?) to do so.
– dave_thompson_085
10 hours ago
@dave_thompson_085: I've updated the answer to be more precise with the wordings.
– Lie Ryan
4 hours ago
add a comment |
Yes you can, with some caveats.
Normally, letsencrypt certificate are valid for a single FQDN. So you can create an domain-identified only (DV) certificate for static.example.com and an EV-identified certificate for your root domain.
Note be careful that another consideration applies when using wildcard certificate and some multi domain certificate. Some CAs (including LetsEncrypt) may issue a wildcard that will also be valid for the root domain because the CA may automatically add the root to the SAN (subject alternative name) even if you don't explicitly list your root domain when requesting the certificate (the CA can do this since wildcard certificate verification method requires that you demonstrate control/ownership of the domain's DNS). Check the SAN field of the certificate to be sure that your certificate are covering exactly what you expected and no more.
A couple security notes though, be careful of server settings that may apply to all subdomains, like certain Cookies and HSTS config.
answered 12 hours ago
Lie RyanLie Ryan
23.4k34977
2
Multidomain and wildcard are quite different things; LE does the first semiautomatically but not the second. Even if an LE cert does mistakenly include the bare domain, it's perfectly valid to not use that cert for that domain, as long as you can configure your webserver(s?) to do so.
– dave_thompson_085
10 hours ago
@dave_thompson_085: I've updated the answer to be more precise with the wordings.
– Lie Ryan
4 hours ago
add a comment |
Yes you can, with some caveats.
Normally, letsencrypt certificate are valid for a single FQDN. So you can create an domain-identified only (DV) certificate for static.example.com and an EV-identified certificate for your root domain.
Note be careful that another consideration applies when using wildcard certificate and some multi domain certificate. Some CAs (including LetsEncrypt) may issue a wildcard that will also be valid for the root domain because the CA may automatically add the root to the SAN (subject alternative name) even if you don't explicitly list your root domain when requesting the certificate (the CA can do this since wildcard certificate verification method requires that you demonstrate control/ownership of the domain's DNS). Check the SAN field of the certificate to be sure that your certificate are covering exactly what you expected and no more.
A couple security notes though, be careful of server settings that may apply to all subdomains, like certain Cookies and HSTS config.
answered 12 hours ago
Lie RyanLie Ryan
23.4k34977
Yes you can, with some caveats.
Normally, letsencrypt certificate are valid for a single FQDN. So you can create an domain-identified only (DV) certificate for static.example.com and an EV-identified certificate for your root domain.
Note be careful that another consideration applies when using wildcard certificate and some multi domain certificate. Some CAs (including LetsEncrypt) may issue a wildcard that will also be valid for the root domain because the CA may automatically add the root to the SAN (subject alternative name) even if you don't explicitly list your root domain when requesting the certificate (the CA can do this since wildcard certificate verification method requires that you demonstrate control/ownership of the domain's DNS). Check the SAN field of the certificate to be sure that your certificate are covering exactly what you expected and no more.
A couple security notes though, be careful of server settings that may apply to all subdomains, like certain Cookies and HSTS config.
answered 12 hours ago
Lie RyanLie Ryan
23.4k34977
edited 4 hours ago
answered 12 hours ago
Lie RyanLie Ryan
23.4k34977
answered 12 hours ago
Lie RyanLie Ryan
23.4k34977
answered 12 hours ago
Lie RyanLie Ryan
23.4k34977
23.4k34977
2
Multidomain and wildcard are quite different things; LE does the first semiautomatically but not the second. Even if an LE cert does mistakenly include the bare domain, it's perfectly valid to not use that cert for that domain, as long as you can configure your webserver(s?) to do so.
– dave_thompson_085
10 hours ago
@dave_thompson_085: I've updated the answer to be more precise with the wordings.
– Lie Ryan
4 hours ago
add a comment |
2
Multidomain and wildcard are quite different things; LE does the first semiautomatically but not the second. Even if an LE cert does mistakenly include the bare domain, it's perfectly valid to not use that cert for that domain, as long as you can configure your webserver(s?) to do so.
– dave_thompson_085
10 hours ago
@dave_thompson_085: I've updated the answer to be more precise with the wordings.
– Lie Ryan
4 hours ago
2
2
Multidomain and wildcard are quite different things; LE does the first semiautomatically but not the second. Even if an LE cert does mistakenly include the bare domain, it's perfectly valid to not use that cert for that domain, as long as you can configure your webserver(s?) to do so.
– dave_thompson_085
10 hours ago
Multidomain and wildcard are quite different things; LE does the first semiautomatically but not the second. Even if an LE cert does mistakenly include the bare domain, it's perfectly valid to not use that cert for that domain, as long as you can configure your webserver(s?) to do so.
– dave_thompson_085
10 hours ago
@dave_thompson_085: I've updated the answer to be more precise with the wordings.
– Lie Ryan
4 hours ago
@dave_thompson_085: I've updated the answer to be more precise with the wordings.
– Lie Ryan
4 hours ago
add a comment |
There are three options for this situation:
- Go with wildcard ssl certificate to secure your root and its sub domains because it remains easy for you because through option you will have to manage only one certificate for both root and its sub domain that helps to save your time & money.
- If want EV SSL for root domain example.com and also want to secure sub domain static.example.com then go for Symantec EV SSL which now gives facility to secure multi domain with it. (Usually remains high in the price).
- If want EV SSL for root domain example.com and also want to secure sub domain static.example.com then other affordable option is EV Multi Domain SSL because it helps you to get ev ssl for your all multiple domains (which you will include in SAN category). Means your both both root as well as sub domain will be secured with EV SSL.
answered 5 hours ago
DanaDana
113
Your answer is a little short: you mention a few options as bullet points, but not what pros and cons are for each option. The answer also contains some typos. It's a good start for a useful answer, but to get more upvotes, you might want to expand the answer.
– Luc
4 hours ago
Thank you for keeping my attention to that.
– Dana
3 hours ago
add a comment |
There are three options for this situation:
- Go with wildcard ssl certificate to secure your root and its sub domains because it remains easy for you because through option you will have to manage only one certificate for both root and its sub domain that helps to save your time & money.
- If want EV SSL for root domain example.com and also want to secure sub domain static.example.com then go for Symantec EV SSL which now gives facility to secure multi domain with it. (Usually remains high in the price).
- If want EV SSL for root domain example.com and also want to secure sub domain static.example.com then other affordable option is EV Multi Domain SSL because it helps you to get ev ssl for your all multiple domains (which you will include in SAN category). Means your both both root as well as sub domain will be secured with EV SSL.
answered 5 hours ago
DanaDana
113
Your answer is a little short: you mention a few options as bullet points, but not what pros and cons are for each option. The answer also contains some typos. It's a good start for a useful answer, but to get more upvotes, you might want to expand the answer.
– Luc
4 hours ago
Thank you for keeping my attention to that.
– Dana
3 hours ago
add a comment |
There are three options for this situation:
- Go with wildcard ssl certificate to secure your root and its sub domains because it remains easy for you because through option you will have to manage only one certificate for both root and its sub domain that helps to save your time & money.
- If want EV SSL for root domain example.com and also want to secure sub domain static.example.com then go for Symantec EV SSL which now gives facility to secure multi domain with it. (Usually remains high in the price).
- If want EV SSL for root domain example.com and also want to secure sub domain static.example.com then other affordable option is EV Multi Domain SSL because it helps you to get ev ssl for your all multiple domains (which you will include in SAN category). Means your both both root as well as sub domain will be secured with EV SSL.
answered 5 hours ago
DanaDana
113
There are three options for this situation:
- Go with wildcard ssl certificate to secure your root and its sub domains because it remains easy for you because through option you will have to manage only one certificate for both root and its sub domain that helps to save your time & money.
- If want EV SSL for root domain example.com and also want to secure sub domain static.example.com then go for Symantec EV SSL which now gives facility to secure multi domain with it. (Usually remains high in the price).
- If want EV SSL for root domain example.com and also want to secure sub domain static.example.com then other affordable option is EV Multi Domain SSL because it helps you to get ev ssl for your all multiple domains (which you will include in SAN category). Means your both both root as well as sub domain will be secured with EV SSL.
answered 5 hours ago
DanaDana
113
edited 3 hours ago
answered 5 hours ago
DanaDana
113
answered 5 hours ago
DanaDana
113
answered 5 hours ago
DanaDana
113
113
Your answer is a little short: you mention a few options as bullet points, but not what pros and cons are for each option. The answer also contains some typos. It's a good start for a useful answer, but to get more upvotes, you might want to expand the answer.
– Luc
4 hours ago
Thank you for keeping my attention to that.
– Dana
3 hours ago
add a comment |
Your answer is a little short: you mention a few options as bullet points, but not what pros and cons are for each option. The answer also contains some typos. It's a good start for a useful answer, but to get more upvotes, you might want to expand the answer.
– Luc
4 hours ago
Thank you for keeping my attention to that.
– Dana
3 hours ago
Your answer is a little short: you mention a few options as bullet points, but not what pros and cons are for each option. The answer also contains some typos. It's a good start for a useful answer, but to get more upvotes, you might want to expand the answer.
– Luc
4 hours ago
Your answer is a little short: you mention a few options as bullet points, but not what pros and cons are for each option. The answer also contains some typos. It's a good start for a useful answer, but to get more upvotes, you might want to expand the answer.
– Luc
4 hours ago
Thank you for keeping my attention to that.
– Dana
3 hours ago
Thank you for keeping my attention to that.
– Dana
3 hours ago
add a comment |
overer is a new contributor. Be nice, and check out our Code of Conduct.
overer is a new contributor. Be nice, and check out our Code of Conduct.
overer is a new contributor. Be nice, and check out our Code of Conduct.
overer is a new contributor. Be nice, and check out our Code of Conduct.
Thanks for contributing an answer to Information Security Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f204359%2flets-encrypt-and-ev-certificates-for-different-hosts-in-the-same-domain%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
I don't think the browser cares to displays a green bar for assets (images, css, javascript) so yes, you probably can.
– Salman A
2 hours ago