Multi-Domain SSL Setup

SSL Setup for multiple domains/subdomains is different than single-domain or wildcard domain setup. There are 2-ways to setup this (as far as I know) – using Subject Alternative Names and Server Name Indication (SNI)

In this article, we will use “Subject Alternative Names” method.

Use Cases

This tutorial is intended for the following types of use case. If you are trying to setup something else, please ignore this.

non-www and www version of your site

1. example.com
2. www.example.com

wildcard (all subdomains) and apex/root/naked domain

1. example.com
2. *.example.com

Please note that most wildcard SSL does not protect your root domain i.e. example.com

altogether different domains

1. example.com
2. example.net
3. google.com
4. rtcamp.com
5. www.example.com

Process

Different companies offer different type of SSL certificates. They have different type of interfaces for CSR signing and certificate generation. So we will outline process on your server-side only (which should remain common across all Ubuntu server)

OpenSSL Config File

Copy OpenSSL conf

By default, when you are are running OpenSSL commands, it is picking config from /etc/ssl/openssl.cnf file.

Unless you are configuring only one certificate on your server, it’s better to copy OpenSSL config file to website’s cert folder:

cp /etc/ssl/openssl.cnf /var/www/example.com/cert/example.com.cnf

Editing Config File

Open /var/www/example.com/cert/example.com.cnf

Look for  [ req ] section. Find add uncomment following line:

req_extensions = v3_req

If you don’t find a line like above, you can add one.

This will make sure our next section [ v3_req ] is read/used.

In [ v3_req ] section, add following line:

subjectAltName = @alt_names

It will look like:

[ v3_req ]

# Extensions to add to a certificate request

basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names

Finally add a new section called [ alt_names ] towards end of file listing all domain variation you are planning to use.

[ alt_names ]
DNS.1 = www.example.com
DNS.2 = example.com

Note: I could n’t find out whether we need to add domain used in common-name field again here. So I added it again here. Now in common-field, we use www.example.com version – if SSL is for www and non-www versions of domains.

Now you have your OpenSSL config file ready.

OpenSSL Private Key & CSR

Make sure you are currently working in cert folder for your site:

cd /var/www/example.com/cert/

Private Key

Run following command to generate private key. Do not use passphrase as nginx will use this private key.

openssl genrsa -out example.com.key 2048

Certificate Signing Request – CSR generation

Next, we will generate CSR using private key above AND site-specific copy of OpenSSL config file.

openssl req -new -key example.com.key -out example.com.csr -config example.com.cnf

Please note -config switch. If you forget it, your CSR won’t include (Subject) Alternative (domain) Names.

Verify CSR

Since sending CSR and getting certificate is time consuming process, it’s better to verify if CSR is generated correctly.

Run following command:

openssl req -in example.com.csr -noout -text

You will see something like below in output. Please make sure you read highlighted area.

Certificate Request:
    Data:
        Version: 0 (0x0)
        Subject: C=IN, ST=MH, L=PUNE, O=RTCAMP SOLUTIONS PRIVATE LIMITED., CN=www.example.com/emailAddress=admin@example.com
 [...]
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Key Usage: 
                Digital Signature, Non Repudiation, Key Encipherment
            X509v3 Subject Alternative Name: 
                DNS:www.example.com, DNS:example.com
 [...]

Submitting CSR and Requesting certificate

Once you have CSR, the process of submitting it is online and often coupled with extra steps depending of certificate provider.