[gentoo-server] (solved)Re: CONCLUSION cannot I save this LOTS of money?

[Zhang Weiwu]

Hello all. My question is about how to save money if I have lots of sub 
domain names that needs SSL web servers.

Traditionally, if you have many different subdomains that must have SSL 
certificate, and you must have the certificate be recognized by most 
browsers (recognize means the browser does not display warning to your 
certificate, but instead trust your certificate as secure), you need to 
buy one certificate for each subdomain. This is a waste of money in case 
you have 100 web server domain names for balance purpose or whatever.

Say, you have www1.company.com, www2.company.com ... www84.company.com, 
you need to pay for 84 seperate licenses.

Before I make conclusion, the administators must be aware under the 
situation I mensionted above (must have SSL certificate, must display no 
warning on most user's browsers), each host (more precisely, each IP 
address) could only have one certificate installed.

Many people posted helpful ideas and suggestions to my question, but in 
case that the situation is like me (must have SSL certificate, must 
display no warning on most user's browsers), the availabe choices are:

1) to buy a certificate from CAs that could issue wilde card 
certificate, which is the kind of single certificate that works for 
multi-sub-domains, like *.mycompany.com

As far as I know, one CA that could issue wildcard is FreeSSL 
(www.freessl.com). There are probably other issuers that could do it, 
especially the chained issuers might be able to issue wildcard 
certificates. However you need to judge if they are trust worthy from 
the size and requirement of your business.

2) (as suggested by Vegard Figenschou and Billy. Use only one domain, 
one certificate, just centralize the service you need

certificate for on a particular site and redirect the other sites to it,
for the particular pages that need encryption Ie:

a.mysite.com -> secure.mysite.com/a
b.mysite.com -> secure.mysite.com/b
c.mysite.com -> secure.mysite.com/c


So far, I do not see other possibilities (in the situations I mentioned 
above)

Sri Gupta gave some very valuable information on pricing and market 
situation:

>$799 Geotrust (http://geotrust.com/web_security/truebusinessidwild.htm)
>$449 InstantSSL (comodo chained to GTE Cybertrust) (http://www.instantssl.com/ssl-certificate-products/ssl/wildcard-ssl-premiumssl_wildcard.html?currency=USD&region=North%20America&country=CA)
>$449 Digicert (digicert chained to GTE Cybertrust) (http://www.digicert.com/wildcard-ssl-certificates.htm)
>$299 Freessl (freessl chained to UTN USERFirst-Network) (http://www.freessl.com/chainedssl/chainedssl_wildcard.html)
>
>There are more.  The GTE/UTN chained certs should work in IE 5.0 and up, the
>geotrust cert should work in anything newer than netscape/ie 4.
>If you're getting a chained cert, might as well get the cheap one.
>If you need compatibility, get the geotrust one.
>