A multi-domain (or SAN) SSL certificate protects several independent domains or subdomains with a single certificate. For example, a single certificate may include pelda.hu, pelda.com and masikceg.hu, each with their www versions.

What does SAN stand for?

The SAN (Subject Alternative Name) is the field in the certificate that lists the domain names for which it is valid. Browsers now check only this field, so in fact every certificate has a SAN field: even a single-domain certificate will list pelda.hu and www.pelda.hu. The term ‘SAN certificate’ refers to the fact that this field may contain several different domains.

When is it best to make a choice?

• Multiple domains on one website: when the same site is accessible via several different domain extensions (pelda.hu, pelda.eu, pelda.com).
• Multiple small websites on a single server: if you wish to manage several of your own domains with a single certificate.
• Mail servers: the mail server is often accessible under several names (for example, mail.pelda.hu, autodiscover.pelda.hu); a single certificate is sufficient for these.
• Known, limited number of subdomains: if you only need to protect a few, pre-defined subdomains, a SAN certificate may be a viable alternative to a Wildcard certificate.

SAN or Wildcard?

	SAN (Multi-Domain)	Wildcard
What does it protect?	the various domains and subdomains listed	all subdomains of a domain that are one level below it
Various domains	Yes	no
New subdomain	A reissue is required	automatically applied
Visibility	All names are listed publicly on the certificate	Only *.pelda.hu is listed

If you need a large number of subdomains that are not known in advance, a Wildcard SSL certificate is the better choice.

What should you look out for?

• All domains must be validated. The certificate authority checks that the holder has control over all domains listed in the certificate, and this must be done again each time the certificate is renewed. If the validation of a domain is delayed, the issuance of the entire certificate will be delayed. A separate article explains the methods of domain validation.
• To amend the list, the certificate must be reissued. If you add a new domain or remove one, the certificate must be reissued with the updated list.
• The names are public. All domains listed in the certificate are visible to anyone, and the certificates are also recorded in the public Certificate Transparency logs. If you do not want it to be apparent that your two domains are related, use separate certificates.
• Shared key. All domains use the same private key. If the key is compromised, all domains are affected and the certificate must be replaced on every server.
• Joint expiry. All domain certificates expire and are renewed at the same time, which is convenient, but a missed renewal will affect all domains.

Multi-Domain SSL at aWh

Our Multi-Domain SSL certificate protects one main domain and two additional domains, both with and without the www prefix. Issuance via domain validation usually takes just a few minutes. If you only need to secure one domain, the Domain SSL is suitable; if the free option is sufficient, the Let’s Encrypt certificate included with our hosting plans is also suitable, as it can cover multiple domain names.