1

I am a Sitecore Developer. Currently I am working through Sitecore upgrade process.Upgrading applications to S9.2 from S8.2.

I am helping my team to make TEST and PROD servers ready for Sitecore installations. One question I have is which certificate is more preferred among these two certificates.

Wildcard Cert VS Multi Domain/SANS certs?

Also, trying to understand why to choose one over the other. What are the pros and cons for both of them.

Want to use Wildcard certs but need strong reasons to justify it's need.

Can anyone please explain.

Really appreciate your help.

Trupti

Improve this question
3
  • sectigostore.com/page/multi-domain-ssl-vs-wildcard-ssl
    – Gatogordo
    May 28, 2020 at 6:18
  • This is a "bang for your buck" deal, as there's no security difference. Wildcards are cheaper if you need more than about 15 hosts on your SAN, otherwise the SAN is generally cheaper. If you don't know all your host names in advance you must use a wildcard. SANs can also be used for multiple domains, not just multiple hosts, so as long as the number of hosts in each domain is known in advance, and not too great in number, the SAN option is normally the cheapest approach. Some IT depts don't like wildcards because it can be hard to tell where they have been used once they expire.
    – Richard Hauer
    May 28, 2020 at 14:46
  • Thanks Richard for very helpful information. Really helped me think in which direction to go.
    – Trupati Rajendra Dave
    May 29, 2020 at 20:28

1 Answer 1

Reset to default
1

I think this is more of an opinion based question but I am writing this answer based on my experience. Let's start with understanding the Wildcard Cert and Multi-Domain/SANS certs.

Wildcard Cert - A Wildcard SSL Certificate allows users to secure an unlimited number of sub-domains, at a specific level, for one domain on one certificate. for example, Sitecore is using sitecore.net as a wildcard Certificate, it has multiple subdomains such as doc.sitecore.net, dev.sitecore.net, community.sitecore.net, kb.sitecore.net etc.

Multi-Domain/SANS certs - A Multi-Domain SSL certificate allows users to secure multiple Fully Qualified Domain Names (FQDN) on one or more certificate. This means you may have one or more certificates with multiple domains. For example, if you have multiple websites with different-different domains in that case you need to use Multi-Domain Certification.

When a certificate only has one SAN field and it contains a reference to a single website, then it’s a single-domain certificate. If that one SAN field contains an asterisk in the website name (e.g. ‘*.yourwebsite.com’) then it’s a wildcard certificate. If the certificate has many SAN fields, then it’s a multi-domain certificate. Multi-domain certificates sometimes have 100 or more SAN fields, and some or all of these fields may contain wildcards, creating a hybrid “multi-domain wildcard” certificate.

There are no specific pons and cons, it depends on your requirements. If you have a specific requirement of multiple domains or you want a separate domain for each environment then you can go with multi-domain certificate. But generally, we use subdomains for the different-different environment and use single domain wild-card certificates such as cm.test.mydomain.com, cd.test.mydomain.com, cm.prod.mydomain.com, etc.

The best option is to use the multi-domain wildcard certificate when you have a multi-domain website with multiple environments. for example, you have 3 brands website with different domain brand1.com, brand2.com, brand3.com as public websites, and multiple environments such as DEV, TEST, and PROD with main website mainbrand.com. In this case, you will have wildcard SAN fields for *.mainbrand.com and single entries for other public websites. You can use the same wildcard for your xConnect and Solr as well.

Improve this answer
1
  • Thank you so much Mahendra, this really explains which one we should go for. Really appreciate your help.
    – Trupati Rajendra Dave
    May 29, 2020 at 20:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.