Unlimited Domains, Subdomains Certs with startssl.com?

I have been looking for an affordable solution for a client of mine. In short, we developed aa web based application for this client through which he is going to establish partnerships with other firms that are able to modify the branding css files but for which the application is fully managed on my clients servers (no code is hos开发者_如何学运维ted by partners).

Currently, the way things work is that each of these partners is assigned a subdomain off a white label domain such as partner1.application.com.

Also, currently each partner has the ability of assigning his own domain name to replace his assigned subdomain name which he does by pointing his domain name through an A-Name record to the applications IP address on our end. We have also tested this with a C-Name record which works fine.

Now to the question...

As things stand right now the problem is that when a partner assigns his own custom domain name then all such admin pages show security certificate errors (which of course is expected). This does not happen when his uses his assigned subdomain name which uses a GoDaddy Wildcard cert.

So, what I have been looking for is a way to secure such "partner" domain names with valid ssl certificates.

I came across a very interesting product/service being provided by startssl.com through which apparently this can be done but I wanted to see if this is indeed possible to anyones knowledge or if there is a different alternative?

You can have a "wildcard" SSL certificate, valid for all subdomains - e.g. for *.example.com . This is indeed possible, useful - and more expensive than a single hostname certificate (e.g. for www.example.com).

There are various SSL certificate providers, and most can get you a wildcard certificate, so you're not limited in your choice by this aspect; you may want to evaluate the providers on other parameters.

However, when you add another domain name into the mix, it becomes complicated - you could have Subject Alternate Names, but managing them would be kind of painful: see e.g. this question on ServerFault