Advantages (or lack thereof) of a single SAN SSL Certificate over multiple SSL Certificates

Question

I am running a website with multiple subdomains, each with its own SSL certificate.

It's time to renew, and while the current certificate uses SAN and has an entry for each subdomain, I am questioning the convenience of this approach - as I can find three individual SSL certificates for apparently cheaper price than a single SSL with 3xSAN entries. I am using IIS 8.5.

Are there any particular drawbacks for going for a multiple individual SSLs?

http://serverfault.com/q/109800/126632 – Michael Hampton Nov 14 '16 at 16:45 — Michael Hampton, Nov 14 '16 at 16:45

score 1 · Accepted Answer · edited Apr 13 '17 at 12:14

1

Multiple SSL certificates on a single IP address requires SNI. If your clients do not support SNI, then they'll end up on whatever your default binding is. Having a SAN certificate is also potentially less maintenance, as it's just one cert to renew every year or two.

But you are correct in your assumption that SAN certificates are more expensive than 3x individual certs. This is because certificates are run like a cartel. So if you want to save a few bucks and are willing to sacrifice clients that don't support SNI - go for it. Get your three individual certs at a fraction of the price of a SAN.

edited Apr 13 '17 at 12:14

Community

1

answered Nov 14 '16 at 16:47

Mark Henderson

68,316
31
175
255

Thanks. What is SNI, and is this a webserver or browser feature? – Emanuele Ciriachi Nov 14 '16 at 16:52
1

It is both. [SNI = Server Name Indication](https://en.wikipedia.org/wiki/Server_Name_Indication). Its role is to solve the issue of a web server and web client not being able to negotiate which domain they want, before negotiating SSL. – Mark Henderson Nov 14 '16 at 16:53
2

SAN certificates are free from Let's Encrypt. – Michael Hampton Nov 14 '16 at 16:56
3

Oh yeah. I'm ashamed to admit I forgot about them for a moment in my induced rage against traditional certificate vendors. – Mark Henderson Nov 14 '16 at 16:57
Thanks. This is for our Intranet website, so our IT has full control on which browsers we use - and all the ones we use currently support SNI. Triple standard SSL it is then! – Emanuele Ciriachi Nov 14 '16 at 16:58

score 0 · Answer 2 · answered Nov 29 '16 at 06:37

A better option is, get the SSL certificate individually.

You need to spend more time in purchase and installation process, but if the budget is a concern then I suggest you to go with Individual SSL.

Note: to get more discounts and get rid of every year renewal, go with multi-year option during purchase.

Single Domain SSL vs Multi Domain SSL

3 Individual SSL’s price is very low than the price of a single SAN SSL.
SSL management time of SAN SSL would be less compared with individual SSL management.
In SAN SSL, you can add/remove a domain, but in individual SSL there is no option to add/remove.

I found, Comodo Positive Multi-Domain/SAN SSL certificate which may cost you $19/year, which is I think lesser than the price of three individual SSL certificate.

Advantages (or lack thereof) of a single SAN SSL Certificate over multiple SSL Certificates

2 Answers2