A multi-domain SSL certificate — also called a SAN certificate (Subject Alternative Names) — lets you secure multiple distinct domains with HTTPS using a single certificate. Instead of buying and installing one certificate per domain, you manage all of them from a single file.
What Is a Multi-Domain SSL Certificate?
Traditional SSL certificates cover only one domain (for example, mycompany.com). If you also need to secure mystore.com and myblog.net, you'd have to buy three separate certificates.
A SAN certificate solves this: it uses the Subject Alternative Names field of the X.509 standard to list multiple domain names within the same certificate. A single certificate can cover up to 100 or more domains depending on the certificate authority (CA).
Examples of names a SAN can cover:
company.comcompany.co.ukstore.company.comanotherdomain.netwww.anotherdomain.net
All protected with a single key pair and a single renewal process.
How a SAN Certificate Works Technically
When a browser connects to your server, it verifies that the domain name it's accessing appears in the certificate. In a SAN certificate, the server presents a single certificate that contains the full list of authorized domains in the subjectAltName field.
The process in brief:
- The browser initiates the TLS handshake with the server.
- The server sends the SAN certificate with all listed domains.
- The browser checks whether the requested domain appears in that list.
- If it matches and the certificate is signed by a trusted CA, the connection is established as secure (padlock icon).
- If the domain is not in the list, the browser shows a security warning.
Adding or removing domains requires reissuing the certificate (not renewing it) — the CA generates a new certificate with the updated list. Most CAs do this at no extra charge within the validity period.
SAN Certificate vs Wildcard: Key Differences
These two certificate types are frequently confused. The fundamental distinction:
| Feature | Multi-Domain SSL (SAN) | Wildcard (*) |
|---|---|---|
| What it covers | Specific domains listed explicitly | All subdomains of one base domain |
| Example | a.com, b.net, c.co.uk |
*.company.com |
| Multiple root domains? | Yes | No (one root domain only) |
| Unlimited subdomains? | No (each must be listed) | Yes (any subdomain of the root) |
| Adding new domains | Certificate reissue required | Automatic if it's a subdomain of the root |
| Typical cost | $50 – $400 USD/year (varies by domain count) | $70 – $300 USD/year |
Have several distinct root domains? The SAN is your option. Have one domain with many frequently changing subdomains? A wildcard is more convenient.
There's also the combined SAN Wildcard: a certificate that lists multiple root domains AND includes a wildcard entry for each one's subdomains. It's the most flexible but also the most expensive.
When Should You Use a Multi-Domain SSL Certificate?
A SAN is the right choice when:
- You operate multiple brands or projects with distinct domains (
.com,.co.uk,.net) from the same server or company. - You run a Microsoft Exchange server or mail server that needs to simultaneously secure
mail.company.com,autodiscover.company.com, andcompany.com— Exchange requires all of them. - You manage hosting clients' sites and need a single certificate per server.
- You need to secure the domain with and without
wwwplus international versions (company.es,company.com.au). - You want to simplify administration: one expiry date, one renewal process.
To learn more about the different certificate types available, visit our SSL security and certificates section.
How to Get and Install a Multi-Domain SSL Certificate
The general process, regardless of which CA you choose:
- Choose the validation level: DV (domain only, fastest), OV (also verifies the company), or EV (thorough verification, displays company name in some browsers).
- Generate a CSR (Certificate Signing Request) on the server, including all domains you want to cover in the SAN field. OpenSSL allows this via a configuration file that lists all
subjectAltNameentries. - Submit the CSR to the CA and complete the domain validation process (typically clicking a confirmation email or adding a DNS/TXT record).
- Download and install the issued certificate on your server (Apache, Nginx, cPanel, Plesk).
- Configure 301 redirects from HTTP to HTTPS for each domain.
- Verify that all listed domains show a padlock without mixed content warnings.
The team at elenlace.com handles this entire process for you — from CSR generation to final verification across every domain, ensuring no visitor ever sees a security warning.
Key Takeaways
- A multi-domain SSL (SAN) certificate secures several distinct domains with one certificate, using the Subject Alternative Names field of the X.509 standard.
- It differs from a wildcard: a SAN covers distinct root domains; a wildcard covers all subdomains of a single root domain.
- Ideal for businesses with multiple brands, Exchange mail servers, hosting agencies, and multi-country projects.
- Adding a new domain requires reissuing the certificate, not renewing it — most CAs do reissues at no extra charge.
- A single SAN certificate reduces costs, simplifies renewals, and centralizes security management.
Need to protect multiple domains at once? The team at elenlace.com will help you choose the right SAN certificate and install it without hassle.
FAQ
How many domains can a SAN certificate cover?
It depends on the certificate authority and the plan you purchase. Most commercial SAN certificates include between 3 and 5 domains by default, with options to add more (up to 100 or 250 depending on the CA). Some hosting plans include a basic SAN certificate at no extra cost.
Can a SAN certificate cover subdomains too?
Yes, as long as the subdomains are explicitly listed in the SAN field. For example, you can include both company.com and store.company.com and blog.company.com. If you want to cover future subdomains without reissuing, consider adding a wildcard entry (*.company.com) to the same SAN certificate.
Are a SAN and a UCC certificate the same thing?
Yes, essentially. UCC (Unified Communications Certificate) is the commercial name Microsoft popularized for SAN certificates optimized for Exchange and unified communications. Technically they use the same X.509 subjectAltName mechanism; only the marketing name differs.
What happens if I need to add a new domain to the certificate?
You need to ask the CA to reissue the certificate with the new domain added to the SAN list. This is not a renewal: the new certificate will have the same expiry date as the original. Most CAs perform unlimited reissues at no extra charge during the certificate's validity period.
Compare providers
Other providers and guides worth comparing:
