SSL certificates for single domain (www. and without)

add domain.com to the ServerAlias

I assume your cert is only valid for www, so adding domain.com to ServerAlias will serve pages but will give you a certificate error (because the domain "domain.com" won't match the cert domain of "www.domain.com"). That's more a response to yangqi, though, since you indicated you'd be "adding a new cert" so it appears you know you need a new cert. A better bet might have been (or might be) to grab a wildcard certificate that would work with/without your subdomain. Otherwise you'll either need another IP address for the new cert or set up SNI, I think.

If you have mod_rewrite enabled you can always modify the config force www.

If you are talking about eg "www.example.com" and "example.com" you would normally get a single certificate with an extra name specified as a "Subject Alternative Name". (The specific example above is actually often provided at no extra cost by the CA.)

That way you do not need separate certificates and do not need to require SNI support or have multiple IPs.

@haus:

I assume your cert is only valid for www, so adding domain.com to ServerAlias will serve pages but will give you a certificate error (because the domain "domain.com" won't match the cert domain of "www.domain.com"). That's more a response to yangqi, though, since you indicated you'd be "adding a new cert" so it appears you know you need a new cert. A better bet might have been (or might be) to grab a wildcard certificate that would work with/without your subdomain. Otherwise you'll either need another IP address for the new cert or set up SNI, I think.

Afaik, a wildcard cert for *.example.com would not match example.com, so SAN or multiple certs would still be necessary.

@hawk7000:

Afaik, a wildcard cert for *.example.com would not match example.com, so SAN or multiple certs would still be necessary.

Yes, I was apparently remembering seeing a wildcard cert that uses SAN to cover the domain itself. Thank you.

StartSSL offers free class certs with the root domain + 1 subdomain. If the one you purchased doesn't, it might be worth looking at them.

The single certs I get from Namecheap using PositiveSSL Comodo SSL's include both the cn like https://www.example.com https://example.com and Both are included in the cert.

If you use something like https://www.ssllabs.com/ssltest/analyze.html you can get a good analazation of what your server is configured for (The cert, protocols, ciphers) etc… It will show the common names and the alternative names in the top cert section.

I used to use StartSSL until they started getting squirrely saying that any donation page made the site commercial even though it was using PayPal as the processing using it's own SSL certs. The NameCheap ones can be reissued for no extra cost ($25 for StartSSL) and are only around $9 a year).

I wasn't aware StartSSL didn't allow commercial use. Glad I found out about that before using it on a commercial site. I just bought a Comodo from Namecheap. I love them for domain registrations/dns, they're great.