SSL certificates IP and subdomains

For your first question, no, it's not possible. The web server doesn't know what domain you want to access until after the encrypted session begins, and the certificate is needed before session begins. So there's no way for the webserver to know what certificate it should use until after its used the certificate; a paradox.

Wildcard certificates are a solution if the different sites are on subdomains of the same domain, you would use a single certificate for multiple domains (foo.domain.com and bar.domain.com would both use a *.domain.com certificate).

For your second question, no, as long as the failover site uses the same domain; certificates are not tied to IPs, but to domains, as far as the client is concerned.

@Guspaz:

For your first question, no, it's not possible. The web server doesn't know what domain you want to access until after the encrypted session begins, and the certificate is needed before session begins. So there's no way for the webserver to know what certificate it should use until after its used the certificate; a paradox.
Note that technically this isn't an absolute limitation since SNI was introduced (which embeds the server name information within the encrypted session negotiation, so the information is available before the session begins), but I agree in practice at the moment, since unless you know all your clients support it, it may not be a practical solution.

To the OP, you can cover example.com and www.example.com with the "Subject Alternate Names" field in the certificate. For example, the primary CN in the certificate would be for www.example.com (or whichever of the two is your primary use name), but you'd have an alternate name value for example.com (you should also repeat the CN in the SAN field for best compatibility). Making a wildcard certificate (a wildcard value in the CN) would only be needed if you had other hosts/subdomains beneath example.com.

Whether or not your certificate provider lets you create such certificates (or more likely charges more for them) is up to that porvider. Some give them different names like a UC or UCC certificate. Of course, if you're self-signing, do anything you want.

For what it's worth (and only because I just recently had reason to use them, not to try to change to a certificate authority discussion), a free certificate from StartSSL I made recently automatically included the unadorned domain name as an alternate name in the certificate. That is, creating a single host certificate for www.example.com will should include example.com as an alternate name automatically. I've used very few commercial CAs, so maybe that's common behavior, I don't know.

– David

I use apache, and it allows me to setup a cert for a specific vhost. Might consider doing that?

@superfastcars:

I use apache, and it allows me to setup a cert for a specific vhost. Might consider doing that?
That likely uses Server Name Indication (SNI) which requires client support. Client support is actually pretty pervasive, the biggest "blocker" being Internet Explorer running on Windows XP (IE on Vista or 7 is fine). If supporting IE on XP (over HTTPS) isn't a concern for you then using SNI is the ideal solution.

@dbb:

@superfastcars:

I use apache, and it allows me to setup a cert for a specific vhost. Might consider doing that?
That likely uses Server Name Indication (SNI) which requires client support. Client support is actually pretty pervasive, the biggest "blocker" being Internet Explorer running on Windows XP (IE on Vista or 7 is fine). If supporting IE on XP (over HTTPS) isn't a concern for you then using SNI is the ideal solution. Perhaps.. but I'll show you what vhost.conf has in it for that specific cert it needs;

 <virtualhost mywebsite.com:443="">ServerAdmin me@mywebsite.com
        ServerName mywebsite.com
        ServerAlias www.mywebsite.com

        DocumentRoot /path/to/public_html/

        SSLEngine on
        SSLProtocol all -SSLv2
        SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM
        SSLCertificateFile /path/to/ssl/mywebsite.com.crt
        SSLCertificateKeyFile /path/to/ssl/mywebsite.com.key
        SSLCertificateChainFile /path/to/ssl/mysslcompany.ca
        SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown

        CustomLog /path/to/logs/ssl_request.log "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x "%r" %b"
        ErrorLog /path/to/logs/error.log
        CustomLog /path/to/logs/access.log combined</virtualhost>