# Correct approach for multiple domains - one cert or several?

**URL:** <https://community.letsencrypt.org/t/correct-approach-for-multiple-domains-one-cert-or-several/32091>\
**Category:** Help\
**Created:** [April 15, 2017, 1:58am UTC](https://community.letsencrypt.org/t/correct-approach-for-multiple-domains-one-cert-or-several/32091 "2017-04-15T01:58:52Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kris7](https://avatars.discourse-cdn.com/v4/letter/k/8edcca/32.png) [@Kris7](https://community.letsencrypt.org/u/Kris7)\
**Post date:** [April 15, 2017, 1:58am UTC](https://community.letsencrypt.org/t/correct-approach-for-multiple-domains-one-cert-or-several/32091/1 "2017-04-15T01:58:52Z")

</div>

Hi,

I’m having lots of trouble getting multiple certificates working on my server, using CentOS 6 and Apache 2.2.15.

I have several domains, some with lots of subdomains - for example:

[cooldomain.com](http://cooldomain.com)  
[niftydomain.com](http://niftydomain.com)  
[superdomain.com](http://superdomain.com)  
[test1.superdomain.com](http://test1.superdomain.com)  
[test2.superdomain.com](http://test2.superdomain.com)  
[staging.superdomain.com](http://staging.superdomain.com)  
[editing.superdomain.com](http://editing.superdomain.com)  
[www.superdomain.com](http://www.superdomain.com)  
[weirdjavaapp.superdomain.com](http://weirdjavaapp.superdomain.com)

I had thought I should get separate certificates for each domain, so I tried this:

```
./certbot-auto --apache -d cooldomain.com -d www.cooldomain.com

./certbot-auto --apache -d niftydomain.com -d www.niftydomain.com

```

In both cases, I ultimately managed to get certs created:

Congratulations! You have successfully enabled [https://cooldomain.com](https://cooldomain.com) and  
[https://www.cooldomain.com](https://www.cooldomain.com)

Congratulations! You have successfully enabled [https://niftydomain.com](https://niftydomain.com) and  
[https://www.niftydomain.com](https://www.niftydomain.com)

However, I can’t get both certs working at the same time. Every time I tweak the individual virtual host config files and then try to reload, one works and one fails. The one that fails tells me the cert is only good for the other domain:

[www.niftydomain.com](http://www.niftydomain.com) uses an invalid security certificate. The certificate is only valid for the following names: [cooldomain.com](http://cooldomain.com), [www.cooldomain.com](http://www.cooldomain.com)

My individual conf files look like this:

cooldomain-com.conf

```
<VirtualHost *:80>
    DocumentRoot /var/www/vhost/cooldomain
    ServerName cooldomain.com
    ServerAlias www.cooldomain.com
    ErrorLog logs/cooldomain-error_log
    CustomLog logs/cooldomain-access_log common
</VirtualHost>

```

cooldomain-com-le-ssl.conf

```
<VirtualHost *:443>
    DocumentRoot /var/www/vhost/cooldomain
    ServerName cooldomain.com
    ServerAlias www.cooldomain.com
    ErrorLog logs/cooldomain-error_log
    CustomLog logs/cooldomain-access_log common

SSLCertificateFile /etc/letsencrypt/live/cooldomain.com/cert.pem
SSLCertificateKeyFile /etc/letsencrypt/live/cooldomain.com/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateChainFile /etc/letsencrypt/live/cooldomain.com/chain.pem
</VirtualHost>

```

So:

Am I taking the right approach? Should I have a separate cert for each domain (1 for [niftydomain.com](http://niftydomain.com), one for [cooldomain.com](http://cooldomain.com), and so on)?

Or should I do the whole thing as one cert covering [niftydomain.com](http://niftydomain.com), [cooldomain.com](http://cooldomain.com), [superdomain.com](http://superdomain.com) and all of their individual subdomains?

If I’m taking the right approach with one cert per domain, can you suggest any ways to track down the cause of the “only valid for the other domain” error messages? I’ve searched as many pages here and at other sites as I can, and nothing I’ve tried has helped.

Thank you very much.

By the way, is there any way to turn off the site’s search feature? It overrides my browser’s search and makes it impossible to use ordinary page search.

---

<div class="post-metadata">

**Author:** ![sahsanu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sahsanu/32/89984_2.png) [@sahsanu](https://community.letsencrypt.org/u/sahsanu)\
**Post date:** [April 15, 2017, 9:11am UTC](https://community.letsencrypt.org/t/correct-approach-for-multiple-domains-one-cert-or-several/32091/2 "2017-04-15T09:11:17Z")

</div>

Hello @Kris7,

> [@Kris7](#):
>
> However, I can't get both certs working at the same time. Every time I tweak the individual virtual host config files and then try to reload, one works and one fails. The one that fails tells me the cert is only good for the other domain:
> 
> [www.niftydomain.com](http://www.niftydomain.com) uses an invalid security certificate. The certificate is only valid for the following names: [cooldomain.com](http://cooldomain.com), [www.cooldomain.com](http://www.cooldomain.com)

I suppose that is because you don't have `NameVirtualHost *:443` directive defined and/or your default-ssl config file doesn't contain `<VirtualHost *:443>`.

Check what is defined for both directives, go to your apache root conf dir (/etc/apache or /etc/httpd or whatever it is on Centos 6) and execute these commands:

```
grep -ri VirtualHost *
grep -ri NameVirtualHost *

```

This will show if you have defined a VirtualHost with an ip or an \* and the same for NameVirtualHost, you should have all of them as `*:443`.

Also, you should check the Apache error log files, maybe they will show you more info about the issue.

> [@Kris7](#):
>
> Am I taking the right approach? Should I have a separate cert for each domain (1 for [niftydomain.com](http://niftydomain.com), one for [cooldomain.com](http://cooldomain.com), and so on)?

The approach is not right or wrong, it is up to you. Anyway, if you have a lot of subdomains you should take care of [Let's Encrypt rate limits](https://letsencrypt.org/docs/rate-limits/), maybe for those, you want to add all of them in one cert instead of one per sub domain because you could reach the limits.

> [@Kris7](#):
>
> By the way, is there any way to turn off the site's search feature? It overrides my browser's search and makes it impossible to use ordinary page search.

It is a feature of the forum software "Discourse"... you can press **Ctrl-F twice** and you will get what you want, the browser search bar but keep in mind that Discourse doesn't show all the content of the page you are seeing so your browser couldn't be accurate ;).

Cheers,  
sahsanu

---

<div class="post-metadata">

**Author:** ![Kris7](https://avatars.discourse-cdn.com/v4/letter/k/8edcca/32.png) [@Kris7](https://community.letsencrypt.org/u/Kris7)\
**Post date:** [April 15, 2017, 8:29pm UTC](https://community.letsencrypt.org/t/correct-approach-for-multiple-domains-one-cert-or-several/32091/3 "2017-04-15T20:29:40Z")

</div>

Hi sahsanu,

Thank you so much for your very helpful reply!

Those specific grep commands gave me a lot to work with.

I had `NameVirtualHost 23.253.94.42:443` in my /etc/httpd/ports.conf file, but I changed it to `NameVirtualHost *:443` just in case that would help. (It hasn’t, but it probably doesn’t hurt.)

I am seeing this in the logs:

`[warn] _default_ VirtualHost overlap on port 443, the first has precedence`

I will do some additional searching to see if I can find out how to fix that, but do you have any suggestions on how to resolve the overlap?

Thank you again. I really appreciate your help!

---

<div class="post-metadata">

**Author:** ![sahsanu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sahsanu/32/89984_2.png) [@sahsanu](https://community.letsencrypt.org/u/sahsanu)\
**Post date:** [April 15, 2017, 9:04pm UTC](https://community.letsencrypt.org/t/correct-approach-for-multiple-domains-one-cert-or-several/32091/4 "2017-04-15T21:04:48Z")

</div>

Hi @Kris7

Did you check your default-ssl conf file?, it could have a `<VirtualHost _default_:443>` directive. Change `_default_` by `*` or if you don’t need that default-ssl conf file, disable it.

Cheers,  
sahsanu

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [May 15, 2017, 9:10pm UTC](https://community.letsencrypt.org/t/correct-approach-for-multiple-domains-one-cert-or-several/32091/5 "2017-05-15T21:10:55Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.