SSL Choice: Subdomains or Different Domains?
You have 10 subdomains. Instead of buying separate SSL certificate for each, you can get one wildcard certificate.
But if you have 3 different domains (example.com, example.net, example.org), you need multi-domain SSL (SAN).
Wildcard SSL: Single certificate, unlimited subdomains: `*.example.com`. Covers: blog.example.com ✅, api.example.com ✅. Does NOT cover: example.com ❌ (root needs separate), sub.blog.example.com ❌ (nested not covered). Solution: 2 certificates: Wildcard (*.example.com) + Root (example.com), or SAN certificate: example.com + *.example.com (single cert).
Multi-Domain SSL (SAN): Subject Alternative Name - multiple domains in one certificate: example.com, example.net, example.org. Let's Encrypt supports SAN (up to 100 domains, practical limit ~10). Paid SAN: Usually 3-10 domain packages, extra domain +€20-50/domain.
Comparison Table: Wildcard SSL: Unlimited subdomains (single root), root domain ❌ needs separate, nested subdomain ❌, Let's Encrypt ✅ free (DNS challenge), paid €100-200/year, setup 1 cert auto all subdomains. Multi-Domain SSL: Multiple root domains, root domain ✅ included, nested subdomain ✅ if manually added, Let's Encrypt ✅ free (100 domains), paid €150-400/year (3-10 domains), setup each domain manually added.
Use Cases: Scenario 1 SaaS Platform (10 customers, each subdomain): Wildcard SSL (*.saas.com) + Root (saas.com), cost €150/year single cert unlimited subdomains. Scenario 2 Multi-Brand Company (3 brands, 3 domains): Multi-Domain SSL (SAN), cost €200/year 3-domain package. Scenario 3 Microservices Kubernetes (dedicated server, 20 microservices auth.api, user.api, payment.api): Solution 1 Wildcard *.api.example.com (nested subdomain), Solution 2 Ingress controller (cert-manager) with auto Let's Encrypt.
Wildcard SSL Setup: Let's Encrypt wildcard requires DNS challenge: `certbot certonly --manual --preferred-challenges dns -d *.example.com`. Certbot gives TXT record, add to DNS: `_acme-challenge.example.com TXT "abc123..."`. DNS propagate (5-10 min), certbot continues. Domain management from EuroVDC panel.
Multi-Domain SSL Setup: `certbot certonly --nginx -d example.com -d example.net -d example.org`. 3 domains http-01 challenge (port 80 open). Nginx config each domain.
Auto Renewal: Let's Encrypt 90-day validity. Cron job: `0 3 * * * certbot renew --quiet`. Wildcard renewal requires DNS challenge again (manual). Solution: Cloudflare API auto DNS update: `certbot renew --dns-cloudflare --dns-cloudflare-credentials ~/.secrets/cloudflare.ini`.
Cost Analysis (5 subdomains + 3 different domains): Option 1: 5 single SSL (subdomain) + 3 single SSL (domain) = 8 certs × €50 = €400/year. Option 2: 1 Wildcard (subdomain) + 1 Multi-Domain (3 domain) = €150 + €200 = €350/year. Option 3: Let's Encrypt (wildcard + multi-domain) = €0/year (but manual DNS challenge). 50+ subdomains → wildcard inevitable. Cloud server + hosting integrated Let's Encrypt.
Security Difference? No. Wildcard and Multi-Domain same encryption (TLS 1.3, AES-256). Difference only scope. But if wildcard private key stolen, all subdomains at risk. Solution: Key rotation every 90 days.
CDN + SSL: Cloudflare, AWS CloudFront offer own SSL certificate (free tier). Flexible SSL: Browser → Cloudflare HTTPS, Cloudflare → Origin HTTP (insecure). Full SSL: Both sides HTTPS (recommended). If using wildcard, upload origin server certificate to CDN.
E-commerce Which SSL? Single domain: Single SSL (example.com) or Let's Encrypt. Subdomain structure (shop.example.com, blog.example.com) → Wildcard. Multi-brand (brand1.com, brand2.com) → Multi-Domain or separate single SSL. PCI-DSS: SSL type doesn't matter, OV/EV validation level matters.
Wildcard + Multi-Domain Hybrid: Some certificates support both: example.com (root), *.example.com (wildcard), example.net (multi-domain), *.example.net (wildcard multi-domain). Cost: €300-500/year. Ideal for enterprise.
Conclusion Which to Choose? Wildcard SSL: Many subdomains (5+), continuously adding new subdomains (SaaS, microservices), single root domain. Multi-Domain SSL: Different root domains (2-10), few or no subdomains, different brands shared infrastructure. Combine both: Many subdomains and different domains, enterprise solution.
SSL certificate + domain + hosting EuroVDC single panel. Dedicated + cloud server wildcard setup by support team.