A guide to SAN certificates

A SAN certificate (Subject Alternative Name certificate), is a type of SSL certificate that allows multiple domain names to be secured with a single certificate. This is particularly beneficial for organizations that manage several websites or services across different domains and subdomains. Read our guide on SAN certificates to find out how SAN certificates work, why they are important, and how you can get yours.

Introduction

SSL certificates are digital certificates that provide a secure and encrypted connection between a web server and a user's web browser. They are essential to ensure the confidentiality, integrity, and authenticity of data transmitted between the user and the server. If you are a website owner, a valid SSL certificate is vital to protect your customer’s data. Many browsers no longer even load websites that do not have a valid SSL certificate, which makes it almost impossible for users to visit your website.

SSL certificates use encryption algorithms that “scramble” the data that users enter into your website, which makes it impossible for third parties to intercept it. When SSL is correctly implemented, the URL of a website changes to "https://" to indicate a secure connection.

To learn more about how SSL certificates work and what other subtypes there are, take a look at this guide.

What are SAN certificates?

Usually, SSL certificates protect only a single domain. A SAN (Subject Alternative Name) certificate is a type of SSL certificate that allows multiple domain names to be protected with a single certificate. It's especially useful for securing websites that operate under multiple names or have various subdomains.

The SAN certificate specifies a list of associated domain names or IP addresses in the "Subject Alternative Name" field of the certificate. When a connection is initiated, the SSL protocol checks if the domain name being requested matches one of the domain names listed in the SAN field. If there's a match, the connection proceeds securely; if not, the browser may show a warning to the end user.

SAN certificates are particularly suitable for websites that use virtualization or cloud services, which often involve numerous dynamic subdomains. By reducing the need for multiple certificates, SAN certificates help simplify certificate management in these cases and cut down on administrative overhead and cost. Simplified certificate management also strongly reduces the likelihood of human error when it comes to updating and maintaining certificates, which could lead to security breaches.

Benefits and use cases of SAN certificates

SAN certificates offer a wealth of benefits and versatility, and they can seriously simplify certificate management for organizations managing multiple subdomains and services. Here are some key advantages:

1. Flexibility: SAN certificates can secure a variety of domain formats and subdomains on a single certificate. This includes fully qualified domain names (FQDNs) and IP addresses, which is especially useful for securing services like websites and email servers across different domains​.

2. Wildcard support: SAN certificates support wildcard names, which allow you to secure all subdomains of a given domain at a specific level (e.g., *.example.com)​.

3. Scalability: The ability to include up to 500 different names under one certificate makes SAN certificates highly scalable and cost-effective, especially when compared to managing multiple individual certificates​.

4. Efficient management: The ability to reissue SAN certificates with changes to the included names without needing a new certificate each time provides operational efficiencies. This flexibility is particularly advantageous in dynamic IT environments where domain names might frequently change​

5. Security and trust: SAN certificates are available with different levels of validation, including Domain Validation (DV), Organization Validation (OV), and the more stringent Extended Validation (EV), catering to varying degrees of security and trust requirements. OV and EV certifications involve thorough validation processes that provide higher assurance to end-users, which can help boost customer trust and satisfaction​

6. Universal compatibility: SAN certificates are widely supported and recognized by major browsers and devices. This ensures that connections encrypted by a SAN certificate are reliably established across different browsers, without errors or security warnings​.

7. Cost-effectiveness: By consolidating multiple names into a single certificate, SAN certificates reduce the per-name cost for SSL. This makes them a cost-effective solution for securing multiple domains and subdomains​.

SAN certificates are particularly useful for organizations that operate multiple web services requiring secure HTTPS connections, such as e-commerce sites, multi-branch organizations, and businesses offering a variety of online tools and platforms across different domains.

How do you get a SAN certificate?

When you are getting a SAN certificate, there are a few things to pay attention to:

• Selecting a reputable Certificate Authority (CA): 

  • As a trusted issuer of digital certificates, a CA plays a pivotal role in the credibility of your SAN certificate. A CA worth its salt should have a solid reputation for security and reliability, ensuring its issued certificates are both recognized and respected. 

  • For broad compatibility with browsers and devices, it's wise to choose a well-recognized CA like Sectigo.

• Selecting your provider:

  • When you decide to purchase a SAN certificate, you have two options: buying directly from Certificate Authorities or via third-party resellers, such as domain registrars or hosting providers. 

  • Direct purchases from a CA often come with the added benefit of support and guidance, which can be reassuring if you prefer a direct connection with your provider. 

  • Alternatively, resellers may offer more competitive pricing and additional services like simplified management tools for multiple certificates or discounts for bulk purchases. They generally have customer support teams ready to assist with certificate selection and setup. 

  • Be aware that the specifics of buying a SAN certificate may also vary based on where you buy it. If you buy directly from a CA, you'll need to generate a Certificate Signing Request (CSR) on your server, detailing your domain and company. This is a key step in the SSL certificate application process. If you choose a reseller, they'll handle the CSR, which simplifies your task.

  • No matter where you buy your certificate, make sure that your provider offers a secure, straightforward purchasing process. Look for transparency in pricing, a variety of payment options, and accessible customer support to safeguard your purchase from the start.

• Selecting the type of certificate you need:

  • After choosing your CA and provider, pick the SAN certificate type that suits your needs: Domain Validation (DV), Organization Validation (OV), or Extended Validation (EV). DV offers basic, and EV provides the highest level of security. You can learn more about these validation types in our SSL guide.

To secure a SAN certificate at the best price, simply log into the Openprovider control panel to start the purchasing process.

How to install your SAN certificate

Installing your SAN certificate is a straightforward process, but it requires attention to detail to ensure everything is set up correctly. 

1. Before you start, be aware that the installation method may differ based on the server software you are using, so it’s essential to adhere to the guidelines provided either by your hosting provider or directly by the Certificate Authority.

2. Start by accessing your server's control panel or command line interface, depending on what your setup allows. 

3. Here, you will need to input the certificate files provided by the CA—this includes the primary certificate, the private key that was generated along with your CSR, and any intermediate certificates required for your setup.

4. After uploading and configuring these files on your server, make sure that your server is configured to handle HTTPS requests as the default response type, and that it automatically redirects any HTTP traffic to HTTPS. This step is important to ensure that all connections to your site are secure.

Following the installation, it’s a good practice to verify the functionality of your certificate. Use an SSL checker tool to confirm that the certificate is active and functioning correctly across all subdomains linked to your main domain. 

Should you run into any problems or if anything seems amiss, don’t hesitate to reach out to your provider's customer support for assistance. They are there to help ensure that your certificate installation is successful and secure.

Tips for effective certificate management

Buying and installing a SAN certificate does not mean your website is protected forever. These four tips for effective certificate management can help prevent unexpected security issues.

• Be proactive in monitoring the expiry date of your certificate. Allowing it to lapse can result in your website being flagged as insecure, which can deter visitors. We recommend setting up reminders to renew your certificate well in advance of its expiration date.

• Keep your private keys secure. If they are compromised, the security of your certificate is at risk. Store them in a secure location and limit access to them.

• Regularly review and update your list of included domains to ensure every domain that requires protection is covered by your SAN certificate. If you add new (sub)domains to your website infrastructure, remember that they may not be included automatically in the SAN field.

• Stay informed about the latest security practices and updates from your Certificate Authority. This will help you respond quickly to any vulnerabilities or changes in industry standards.

How do you renew your SAN certificate?

The renewal process for a SAN certificate is something you need to handle well before the certificate expires. Typically, your hosting provider or Certificate Authority will send you reminders as the expiration date approaches. It's advisable to start the renewal process at least one month in advance to avoid any lapse in your website's encryption.

Renewing your SAN certificate usually involves generating a new CSR and purchasing a renewal from your CA. You might be able to use the same CSR you used for the original certificate, but some CAs recommend generating a new one for security reasons.

Once your renewal has been processed and you have received your new certificate, you will need to install it on your server, just as you did the first time. After installation, make sure to verify that it is functioning correctly.

Keep records of your renewal dates and the steps you've taken, as this will streamline future renewals. Staying on top of renewal ensures continuous protection and trust for your website's visitors.

Troubleshooting common SSL issues

When implementing SAN certificates, you may run into several common errors:

• Incorrect or missing entries in the SAN field: This is the most common problem that may happen to SAN certificates. It might mean that a critical domain or subdomain is not covered by the certificate, leading to security warnings in browsers. To avoid this issue, be careful to review the list of domains and subdomains that need to be secured before issuing the certificate. If any domains are missing or incorrect, you will need to reissue the certificate with the correct SAN entries. 

• Incorrect certificate renewal: The above issue with missing entries may also occur during the renewal of a SAN certificate when there is a particular risk of domains being omitted or failing to add new ones that are now required. It is recommended to maintain a current list of all domains and regularly update it as your infrastructure changes. Use this list when renewing the certificate to ensure all necessary domains are included.

• Performance issues: Having a large number of SAN entries in a single certificate can sometimes impact the server’s performance, due to the processing overhead associated with managing multiple domains. Make sure that you do not overload a certificate with an excessively large number of SAN entries, and balance the load across several certificates if needed.

If you continue to experience issues after these checks, consult your certificate provider's Knowledge Base or contact their support team. They should be able to provide guidance specific to your situation.

Want to get SSL certificates for the best price? Order your SAN certificates with Openprovider today.