What Is a Multi-Domain SSL (SAN Certificate) and Who Needs It?

What Is a Multi-Domain SSL Certificate?

A Multi-Domain SSL Certificate — also called a SAN Certificate (Subject Alternative Names) or UCC (Unified Communications Certificate) — is a single SSL certificate that can secure multiple different domain names simultaneously. Rather than purchasing and managing a separate certificate for each domain, you use one certificate to cover them all.

For example, if you operate a business with multiple brands or websites, a single Multi-Domain SSL can cover:

• mybrand.com
• mybrand.co.th
• anotherbrand.com
• shop.mybrand.com
• mybrand.net

Instead of five separate SSL certificates, you manage just one. This reduces both cost and administrative overhead significantly.

SAN, Multi-Domain, and UCC — Are They Different?

These terms largely describe the same technology, but their origins differ:

• SAN (Subject Alternative Names) — the technical field within an SSL certificate that lists additional domains the certificate covers
• Multi-Domain SSL — the marketing name used by SSL vendors for this type of certificate
• UCC (Unified Communications Certificate) — a name specifically used in Microsoft Exchange and Office 365 environments, where multiple server names must be secured under one certificate

How a SAN Certificate Covers Multiple Domains

The core of a Multi-Domain SSL is a field called the Subject Alternative Name (SAN) inside the certificate. When a browser opens an HTTPS site, the server returns its certificate, and the browser checks whether the domain typed in the address bar matches one of the names listed in that certificate. Historically, certificates were validated against the Common Name (CN) field, which holds only a single domain. Modern standards instead validate against the SAN field — and SAN can hold a list of many domains in a single certificate.

The process works roughly like this:

1. Create a CSR listing every domain — when generating the Certificate Signing Request (CSR), you specify every domain you want covered. The primary domain goes in the CN, and the rest are added to the SAN list.
2. Prove ownership of each domain — the Certificate Authority (CA) runs Domain Control Validation against every name in the SAN list, not just the primary domain. This is typically verified via a DNS record, a file on the website, or an email challenge.
3. The CA issues one certificate containing every SAN — once all domains are validated, the CA issues a single certificate whose SAN field lists all of them.
4. Install on the server — this one certificate is installed on the server and immediately secures every domain it lists.

As a result, whether a visitor opens mybrand.com or anotherbrand.com, the browser sees that name in the SAN list and shows the padlock and an encrypted connection as normal, with no security warning — all from the same certificate.

Multi-Domain SSL vs Wildcard SSL: What's the Difference?

This is one of the most common questions about SSL types. Both cover multiple domains or names, but they work differently:

Wildcard SSL (*.domain.com)

• Covers the main domain and all subdomains at one level, e.g., *.asiagb.com covers www.asiagb.com, shop.asiagb.com, blog.asiagb.com
• Only works for subdomains of a single domain — it cannot secure a completely different domain name
• Best for sites with many subdomains under one root domain

Multi-Domain SSL (SAN)

• Covers multiple completely different domains, e.g., domain1.com, domain2.com, shop.domain3.net
• Can mix main domains and subdomains from different root domains
• Best for businesses operating multiple distinct domain names

Single vs Multi-Domain (SAN) vs Wildcard Compared

The table below summarizes the differences between the three main SSL types, so you can pick the one that matches your own site structure:

In short: if you have one domain with many subdomains, Wildcard is the most cost-efficient. If you have several unrelated domains or TLDs, Multi-Domain (SAN) is the answer. And if you truly run a single site, a Single Domain SSL from 1,000 THB/year is enough.

Who Should Use Multi-Domain SSL? (Multiple Brands / TLDs)

Multi-Domain SSL is especially well suited to organizations managing several domain names at once — particularly when those domains sit on different TLDs or represent different brands. Groups that benefit most include:

1. Businesses with Multiple Brands or Domains

Companies operating under multiple brand names, each with its own domain, can consolidate SSL management. This is common in holding companies, agencies, or businesses that operate the same product in multiple markets under different domain names.

2. E-commerce with Multiple Storefronts

Online retailers who maintain separate domains for different product categories or regional markets — for example, myshop.com and myshopthailand.co.th — can secure both with a single certificate, simplifying management and reducing cost.

3. Microsoft Exchange and Office 365 Environments

Exchange Server deployments require securing multiple service names on the same server — such as mail.company.com, autodiscover.company.com, and owa.company.com. UCC Certificates are the industry standard for these deployments and are supported natively by Exchange.

4. Agencies and IT Teams Managing Multiple Clients

Web agencies or IT departments managing websites for multiple organizations can consolidate certificate management across client domains, reducing renewal overhead and potentially lowering per-domain costs.

5. One Brand Registered Across Many TLDs to Prevent Brand Squatting

Many businesses register the same brand name across several extensions — for example mybrand.com, mybrand.co.th, mybrand.net, and mybrand.asia — to stop others from grabbing their brand. Even if some of these domains simply redirect to the main one, every domain that answers over HTTPS still needs a valid SSL certificate, or browsers will show a warning. A Multi-Domain SSL handles this entire scenario in a single certificate, so you don't have to buy and renew a separate certificate for each TLD.

Issuing and Installing a SAN Certificate: What to Know

Before ordering and installing a Multi-Domain SSL, there are technical details worth understanding so the process goes smoothly and you avoid unnecessary reissues:

Plan Your Full Domain List Up Front

Because adding or removing a domain later requires a reissue every time, list all the domains and subdomains you expect to use this year before generating the CSR. Many SAN cert plans include a minimum number of SAN slots (e.g. 3-5 names) and let you buy additional SANs individually. Planning ahead lets you purchase exactly the right number of SAN slots.

Every Domain Must Pass Domain Control Validation

The CA validates ownership of every domain in the SAN list, not just the primary one. If some domains aren't fully set up in DNS yet, or you can't access their admin email, issuance will stall until all of them are verified. So make sure you have DNS or web-root control over every domain before placing the order.

Install One Certificate Across All Relevant Servers

If all your domains live on the same server, installing the certificate and its CA bundle (intermediate) once covers every domain. If your domains are spread across multiple servers, you can install the same certificate and private key on each server — just keep the private key secure and transfer it only over encrypted channels.

Understand Reissues and the Shared Expiry Date

Every domain in the certificate shares the same expiry date. When you renew or add a domain, the system issues an entirely new certificate that you must install over the old one on every server. Keep a record of exactly where this certificate is installed, so that at renewal time no server is missed and you don't end up with an expired SSL somewhere.

Pros and Cons of Multi-Domain SSL

Advantages

• Cost-effective — the per-domain price is lower than buying individual certificates, especially for three or more domains
• Simplified management — one certificate, one expiry date, one renewal process
• Flexible coverage — can mix .com, .co.th, .net, .org, and other TLDs in a single certificate
• Server resource efficiency — can use a single IP address for all covered domains

Disadvantages

• Renewal affects all domains — adding or removing a domain from the certificate requires reissuance, which can be disruptive
• Single point of failure — if the certificate is revoked for any reason, all covered domains are affected simultaneously
• May be more expensive than Wildcard — if you have many subdomains under a single root domain, Wildcard SSL is typically more cost-efficient

Multi-Domain SSL from AsiaGB

AsiaGB offers SSL Certificates from RapidSSL, GeoTrust, and DigiCert — all leading Certificate Authorities with full Multi-Domain SSL product lines at DV, OV, and EV validation levels. SSL starts from 1,000 THB/year. If you are unsure whether Multi-Domain or Wildcard SSL is right for your situation, contact the AsiaGB team for a recommendation.

Frequently Asked Questions (FAQ)

How many domains can a Multi-Domain SSL cover?

It depends on the plan and CA. A SAN cert typically comes with a starting number of domains (e.g. 3-5 names) and lets you add SANs one at a time up to that plan's maximum (some plans support dozens or even over a hundred domains). Tell the team how many domains you need so you can pick a plan with the right number of SAN slots at the best value.

Does Multi-Domain SSL also cover subdomains of each domain?

It only covers the subdomains you explicitly list as SAN entries — for example, you must list shop.brandA.com by name for it to be covered. If you want to automatically cover all subdomains of a given domain, consider a Wildcard, or choose a SAN cert that supports Wildcard SAN entries (adding *.brandA.com as one of the SANs), which some CAs offer.

Can I add a domain to the certificate later?

Yes, but it requires a reissue — the CA issues a new certificate containing the added domain, which you then install over the old one on every server. The expiry date stays the same; reissuing doesn't extend it. Planning your full domain list at purchase time avoids this hassle.

Is Multi-Domain SSL really cheaper than buying certificates individually?

It is clearly cheaper once you have three or more domains, because the per-domain price of a SAN cert is lower than buying separate certificates, and it's easier to manage with one expiry date and one renewal. But if your "domains" are really many subdomains under a single root domain, a Wildcard SSL from 5,000 THB/year is usually the better deal.