How can I get SSL for multi level subdomains

Website, Application, Performance Security
1

I seen this topic on forums but I cannot fully understand …
If I have a domain like example.com and I want to have SSL connections at multi level subdomains like:

example.com
www.example.com
abc.def.example.com
abc.def.ghi.example.com

  • Will all multi level subdomains get ssl certficates if I define them individually in the DNS records ?

  • Do I still need an [Advanced Certificate Manager] subscription if I individually define each multi level subdomain in DNS records ?

  • With [Advanced Certificate Manager] subscription, can’t I define just *.example.com DNS record and receive SSL cert when accessing a multi level subdomain as abc.def.ghi.example.com ?

  • Would changing from [free] to [pro] plan help in this case ? e.g can the [pro] plan issue multi level certificates if I define just *.example.com DNS record ?

4

The wildcard can only match one level. *.example.com does not cover abc.def.example.com. You would need a wildcard certificate at *.def.example.com to cover that name. Similarly you would need a wildcard of *.def.ghi.example.com to cover abc.def.ghi.example.com.

2 Likes
5

Hi @adriantnt,

You will need to have ACM and define each subdomain individually.

For example: You have omar.com.
Cloudflare USSL provides the root and 1st level coverage.
So it looks like this, omar.com and *.omar.com.

For 2nd level, it will be like this, omar.com, *.omar.com, and *.www.omar.com.
Please note, the 2nd level will only cover anything on the 2nd level of [hello].www.omar.com. It will not cover say, [hello].api.omar.com, since the subdomain api is not defined in your cert.

Limitations for Universal SSL · Cloudflare SSL/TLS docs.

Alternatively, you can purchase an ACM and enable Total TLS.

Please do read the caveat, as of now, if you delete a specific SSL cert (hostname) it cannot be reissued.

Thank you.

2 Likes
6

Hi. Thanks for the details.
With “ACM and Total TLS enabled”, do I still need to manually define each multi-level host name ?

7

The hostnames will need to be proxied.

Total TLS allows Cloudflare to issue individual certificates for your proxied hostnames.

8

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.