Request a Multi-domain SSL/TLS Certificate

Request and configure SAN certificates covering multiple names, including validation and renewal considerations.

CertOneDec 23, 20195 min read

A multi-domain certificate uses Subject Alternative Names (SANs) to cover several hostnames, whether related subdomains or entirely different domains. This guide covers requesting, validating, and configuring one.

1. What is a multi-domain certificate?

1. Definition

A multi-domain certificate lists multiple names in its SAN extension. An application may label one name as primary and the others as additional names.

2. Coverage

Supported name combinations:

✅ Different domains: example.com, example.net, another-site.com
✅ Related names: example.com, www.example.com, api.example.com
✅ Mixed names: example.com, www.example.com, example.net

3. Advantages

✅ One certificate covers several domains
✅ One certificate to manage
✅ One renewal replaces the full set
✅ Useful for deployments with multiple names

4. Limitations

❌ Adding a name requires reissuance
❌ All names are disclosed in the certificate, and compromise of its key affects all covered names
❌ Paid multi-domain products may cost more than single-domain products

2. Requirements

1. Providers

Free options:

Let's Encrypt through CertOne, acme.sh, or another ACME client
FreeSSL.cn

Paid options:

DigiCert
Sectigo
GlobalSign
Other commercial CAs

2. Name limits

Free certificates:

Let's Encrypt: up to 100 names per certificate in this guide
FreeSSL.cn: subject to the selected offering

Paid certificates:

Products described here commonly support 2–250 names
Price may increase with the number of names

3. Validation

Multi-domain certificates support the methods available from the selected CA:

DNS validation
HTTP validation
Email validation with some CAs

3. Request with CertOne

1. Create a request

Sign in to CertOne
Open Certificates
Click Create certificate
Choose a validation method

2. Enter domain details

Primary domain:

Enter the primary domain, such as example.com

Additional domains:

Click Add domain
Enter the next name
Repeat for the required domains

Example:

Primary domain: example.com
Additional domains:
- www.example.com
- api.example.com
- blog.example.com
- example.net

3. Validate all domains

DNS authorization:

Select a DNS authorization
CertOne creates the required DNS challenge records
Wait for all names to validate

CNAME validation:

View the CNAME records for each domain
Add each record with the relevant DNS provider
Wait for DNS propagation
CertOne checks the records

HTTP validation:

View the HTTP challenge instructions for each domain
Configure the challenge endpoint for every name
Ensure public HTTP access to the file
CertOne checks the records

4. Wait for issuance

After all names pass validation, CertOne requests the certificate:

Usually completes within minutes
90-day certificate validity
Automatic renewal is available

4. Request with acme.sh

1. Multi-domain issuance

~/.acme.sh/acme.sh --issue \
  -d example.com \
  -d www.example.com \
  -d api.example.com \
  -d blog.example.com \
  --webroot /var/www/html

2. DNS validation

export CF_Email="your-email@example.com"
export CF_Key="your-api-key"

~/.acme.sh/acme.sh --issue \
  -d example.com \
  -d www.example.com \
  -d api.example.com \
  --dns dns_cf

3. Install the certificate

~/.acme.sh/acme.sh --install-cert \
  -d example.com \
  --key-file /path/to/key.pem \
  --fullchain-file /path/to/fullchain.pem \
  --reloadcmd "systemctl reload nginx"

5. Request with Certbot

1. HTTP validation

sudo certbot certonly --webroot \
  -w /var/www/html \
  -d example.com \
  -d www.example.com \
  -d api.example.com \
  -d blog.example.com

2. DNS validation

sudo certbot certonly \
  --dns-cloudflare \
  --dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini \
  -d example.com \
  -d www.example.com \
  -d api.example.com

6. Server configuration

1. NGINX configuration

One server block with multiple names:

server {
    listen 443 ssl;
    server_name example.com www.example.com api.example.com;
    
    ssl_certificate /path/to/fullchain.pem;
    ssl_certificate_key /path/to/privkey.pem;
    
    # Add the remaining site configuration here.
}

Multiple server blocks sharing a certificate:

# First domain
server {
    listen 443 ssl;
    server_name example.com;
    
    ssl_certificate /path/to/fullchain.pem;
    ssl_certificate_key /path/to/privkey.pem;
    
    # Add the remaining site configuration here.
}

# Second domain
server {
    listen 443 ssl;
    server_name www.example.com;
    
    ssl_certificate /path/to/fullchain.pem;
    ssl_certificate_key /path/to/privkey.pem;
    
    # Add the remaining site configuration here.
}

2. Apache configuration

One VirtualHost with multiple names:

<VirtualHost *:443>
    ServerName example.com
    ServerAlias www.example.com api.example.com
    
    SSLEngine on
    SSLCertificateFile /path/to/cert.pem
    SSLCertificateKeyFile /path/to/private.key
    SSLCertificateChainFile /path/to/chain.pem
</VirtualHost>

Multiple VirtualHosts sharing a certificate:

<VirtualHost *:443>
    ServerName example.com
    SSLEngine on
    SSLCertificateFile /path/to/cert.pem
    SSLCertificateKeyFile /path/to/private.key
    SSLCertificateChainFile /path/to/chain.pem
</VirtualHost>

<VirtualHost *:443>
    ServerName www.example.com
    SSLEngine on
    SSLCertificateFile /path/to/cert.pem
    SSLCertificateKeyFile /path/to/private.key
    SSLCertificateChainFile /path/to/chain.pem
</VirtualHost>

7. Use cases

1. Multiple brands

Scenario:

One organization manages multiple brands
Each brand uses a separate domain
For example, brand1.com, brand2.com, brand3.com

Advantages:

Cover all brand domains with one certificate
Manage renewal centrally

2. Apex and subdomains

Scenario:

Protect an apex domain and several subdomains
For example, example.com, www.example.com, api.example.com, blog.example.com

Advantages:

Include all required names in one certificate
Simplify certificate management

3. Different domain suffixes

Scenario:

Manage related names under different top-level domains
For example, example.com, example.net, example.org

Advantages:

Include all names in one certificate
Reduce the number of certificates

8. Operational considerations

1. Plan domain coverage

Plan ahead:

Identify every required name before requesting the certificate
Adding a name requires a new certificate
Leave room within the provider's name limit for future reissuance

Name count:

Check the CA's per-certificate limit
Do not include unnecessary domains
Remove obsolete names when reissuing

2. Validation requirements

Every name must validate:

Validate each domain
A failed name can prevent the entire order from completing
Keep validation available for every name

Methods may differ:

Different names may use different supported methods
For example, DNS for some names and HTTP for others

3. Certificate renewal

Renewal requires valid domain authorizations:

Be prepared to validate every name during renewal
DNS API authorization automates this process
With CertOne CNAME validation, keep each delegation record in place for automated renewal

9. Common questions

1. Add a domain

Question: how do I add a name after issuance?

Resolution:

Issued certificates cannot be edited dynamically
Request a replacement containing the new name
Plan the name list and allow room within the CA limit

2. Some domains fail validation

Question: what if only some names fail?

Resolution:

Inspect the failed domains' challenge configuration
Verify their DNS records or HTTP endpoints
Retry validation

3. Remove an unwanted name

Question: what if a certificate contains an unnecessary domain?

Resolution:

Names cannot be removed from an issued certificate
Request a replacement that omits the name
Review the domain list before submitting

10. Multi-domain vs. wildcard

1. Comparison

Feature	Multi-domain	Wildcard
Coverage	Explicit name list	Matching subdomains at one level
New name	Requires reissuance	Already covered if it matches the wildcard
Apex coverage	✅ Can be included	❌ Must be listed separately
Unrelated domains	✅	❌ A wildcard entry covers one suffix
Paid pricing	Product-dependent	Often higher; free options exist

2. Choosing an option

Choose multi-domain when:

You need unrelated domains
The name list is stable and explicit
You need apex domains included

Choose wildcard when:

You have many subdomains at one level
Matching subdomains are added dynamically
You need coverage for those subdomains

Conclusion

Multi-domain certificates suit multiple brands, domain suffixes, or a known set of apex and subdomain names. CertOne, acme.sh, and Certbot can help issue and manage them.

Key points:

✅ One certificate covers several domains
✅ Validate every included domain
✅ Reissue when adding names
✅ Plan the domain list in advance
✅ Use automated certificate management tools

CertOne provides a management interface and automation for multi-domain certificate issuance and renewal.

1. What is a multi-domain certificate?​

1. Definition​

2. Coverage​

3. Advantages​

4. Limitations​

2. Requirements​

1. Providers​

2. Name limits​

3. Validation​

3. Request with CertOne​

1. Create a request​

2. Enter domain details​

3. Validate all domains​

4. Wait for issuance​

4. Request with acme.sh​

1. Multi-domain issuance​

2. DNS validation​

3. Install the certificate​

5. Request with Certbot​

1. HTTP validation​

2. DNS validation​

6. Server configuration​

1. NGINX configuration​

2. Apache configuration​

7. Use cases​

1. Multiple brands​

2. Apex and subdomains​

3. Different domain suffixes​

8. Operational considerations​

1. Plan domain coverage​

2. Validation requirements​

3. Certificate renewal​

9. Common questions​

1. Add a domain​

2. Some domains fail validation​

3. Remove an unwanted name​

10. Multi-domain vs. wildcard​

1. Comparison​

2. Choosing an option​

Conclusion​

1. What is a multi-domain certificate?

1. Definition

2. Coverage

3. Advantages

4. Limitations

2. Requirements

1. Providers

2. Name limits

3. Validation

3. Request with CertOne

1. Create a request

2. Enter domain details

3. Validate all domains

4. Wait for issuance

4. Request with acme.sh

1. Multi-domain issuance

2. DNS validation

3. Install the certificate

5. Request with Certbot

1. HTTP validation

2. DNS validation

6. Server configuration

1. NGINX configuration

2. Apache configuration

7. Use cases

1. Multiple brands

2. Apex and subdomains

3. Different domain suffixes

8. Operational considerations

1. Plan domain coverage

2. Validation requirements

3. Certificate renewal

9. Common questions

1. Add a domain

2. Some domains fail validation

3. Remove an unwanted name

10. Multi-domain vs. wildcard

1. Comparison

2. Choosing an option

Conclusion