Different SSL-certificates for different parts of site

Question

I have a site on example.com that loads all its static components from s.example.com (an amazon cloudfront distribution).

Now i would like to make some pages of example.com to use https so i thought i'd buy a ssl certificate for example.com, but since the pages loads images and other stuff from s.example.com the https will break since some components are not encrypted.

Is it possible to buy a second certificate for s.example.com? The reason i ask is because it's very much cheaper to buy two single-domain-certificates than to buy a wildcard cert.

Answer 1

You should be able to run a page with different https://domains with no alert from the browser as long as all the components inside the page are http or all https.

<img src="https://example.com/a.jpg"/&gt;
<img src="https://s.example.com/b.jpg"/&gt;

You'll have to keep the various certificates up to date.

Answer 2

The problem with various certificates for various (sub)domains is that you must have a dedicated IP for a domain. This is due to SSL design - first SSL connection is established and at this point the certificate is validated. The server doesn't know which certificate to present at this point. Only after successful handshake the HTTP request with domain name is sent.

So you have to buy a wildcard certificate, if you wish to cover both domains and they both sit on the same IP address.

Answer 3

It depends on whether the two hosts are running on the same server and IP address (using virtual hosts) or not.

The easy way is to be able to host example.com and s.example.com on two distinct IP addresses (perhaps the same machine), in which case you can configure a different certificate for each.

If you're constrained to have a single IP address (and port) for the two names, if you want to use two distinct certificates, you would need to use the Server Name Indication (SNI) extension, which is relatively recent (and might not be supported by all browsers, but it seems to work with recent ones).

If you can't use SNI, you'd need the same certificate to be valid for both example.com and s.example.com at the same time, which may be achieved by putting the two DNS entries in the Subject Alternative Name extension, or perhaps by using a wildcard, if the pattern for the two hosts is suitable. These two options are probably more expensive than two distinct certificates, with commercial CAs.

After that, it's a matter of linking to the page content (img...) using https:// links, as @ring0 has already said.