SSL & Subdomains

[Nutter]

I know this isn't a specific eCommerce question, but I'm guessing y'all have the most experience with SSL certificates.

I'm working on a site to allow users to keep track of medical records. Obviously it is going to go through SSL.

The plan is to have the main site as [whatever.com...] or [secure.whatever.com....] But, I also plan to have a development subdomain (dev.whatever.com). It would be a version ahead of the main site to allow me to test it, but I would be most likely testing it with live data so I'd prefer it be secure too. Will this require two SSL certificates, or will one cover both since they'll both be at whatever.com.

I have the .com, .net, and .org address for this. I assume that the SSL for the .com and .net address would have to be different. In a perfect world I'd have the [x.com...] address for users and the [dev.x.net...] address for the development version. This would take two certificates, correct?

Thanks,
- Ryan

[danieljean]

I use a development subdomain too (staging.example.com). The SSL was obtained for the main domain, and everytime I use staging in https, my browser gives me an alert. So the transmission is encrypted, but it appears to be from an untrusted source - perhaps even one that is hijacking your communication.

This scares some customers that have access to the dev server, but if it that's no big deal, there's no need to install a "wildcard" SSL.

[wayzel]

SSL certificates are unique to the www.domainname.com and adding a subdomain will require a seperate certificate. The SSL key is partially generated by the domain name of the site which is why, if the domain names aren't the same, the certificate won't match. A subdomain is, for most purposes, considered a completely unique site from the www.domainname.com site. Your browser will alert you that the certificate does not match the site.

[jollymcfats]

You don't *need* two certificates- the mismatch will not affect the encryption of the link. But you will get an authentication mismatch warning on the dev site, which will annoy everyone who has to work it. There's two parts to an SSL connection- encryption and trust, and the mismatch only affects the trust.

You can generate and self-sign your own SSL certificate for use on the dev site. This is pretty simple to do with the OpenSSL tools on Unix or Windows, and there are plenty of how-tos out there.

The self-signed certificate differs from one you pay for only in the level of trust- not encryption- it provides. When you pay for one, you're paying for a so-called "trusted authority" to vouch for your legitimacy as a business or site operator, and they cryptographicaly sign your certificate to attest this. A browser can verify this and present warm fuzzies to the user when they connect. If you're running your dev site, you don't need to prove to the world at large that you are legit- you already know you're legit, you just want the crypto. So you can save some scratch and self-sign.