One VPS, twelve client domains, and a Let's Encrypt rate limit email at midnight. SSL for multiple domains is not hard once you understand the options. It is easy to mess up when you treat every hostname like it needs its own heroic manual process.
Whether you run an agency reseller account or a single server with a few brands pointed at it, the certificate strategy should match how domains are organized, not how many panic buttons you want in cPanel.
The basics: one IP, many names
Modern servers use SNI (Server Name Indication). The browser says which hostname it wants during the TLS handshake. The server picks the right certificate. One IP can serve many HTTPS sites without a separate IP per domain. That is normal in 2026.
What you need per domain (or group of domains) is a valid certificate that covers the hostnames visitors actually type.
Option 1: one certificate per domain (AutoSSL / Certbot)
cPanel AutoSSL and tools like Certbot issue free Let's Encrypt certs per domain or per vhost. Great for:
- Addon domains on shared or reseller hosting
- Client sites that come and go
- When apex and www both need coverage (often one cert with both names)
Watch renewal automation. HTTP-01 validation needs port 80 reachable and DNS pointing at the server. We covered failure modes in SSL renewal failures and how to avoid them.
Option 2: wildcard certificates
A wildcard covers *.example.ca for one brand. One cert, many subdomains (app, staging, mail portal). It does not cover the bare apex example.ca unless you add it as a SAN or use a cert that includes both.
Wildcards help when one client owns many subdomains under one name. They do not help when you host clientA.ca and clientB.ca unless you buy wildcards for each (expensive) or use per-domain certs (usually cheaper with Let's Encrypt).
Let's Encrypt issues wildcards via DNS-01 validation. You prove control by creating a TXT record. Works well if DNS is stable and automated. Painful if clients control DNS at a slow registrar and you renew manually.
Option 3: multi-domain (SAN) certificates
One certificate listing multiple explicit hostnames: shop.clientA.ca, www.clientB.ca, etc. Commercial CAs sell these; Let's Encrypt can include multiple names on one cert too.
Useful for a small fixed set of related sites. Awkward for agencies adding a new client every week (you reissue when the list changes).
Agency pattern: per-client AutoSSL on reseller
Most Canadian agencies on WHM/cPanel give each client account its own AutoSSL run. Certificates stay scoped to that account. Adding a client domain does not require touching other clients' certs.
Checklist when onboarding a domain:
- DNS A/AAAA points to your server (or correct proxy mode if using Cloudflare)
- Domain added in cPanel with document root set
- Force HTTPS redirect enabled after cert issues
- Mail and unrelated subdomains not forced through broken HTTPS
VPS with nginx or Apache vhosts
Certbot with nginx/Apache plugins can iterate vhosts. Tools like acme.sh support DNS APIs for wildcards. Document which account owns DNS API keys. Rotating keys without updating automation breaks renewals silently.
Staging subdomains (staging.client.ca) need certs too if browsers hit them. Use real certs even on staging, or restrict staging by VPN/IP so you are not training clients to click through certificate warnings.
Cloudflare and origin certificates
If orange-cloud proxy handles public HTTPS, visitors see Cloudflare's edge cert. Your origin still needs TLS between Cloudflare and your server (Full or Full Strict). Origin can use Let's Encrypt, a Cloudflare origin cert, or a long-lived internal cert on strict mode.
Mixing Cloudflare DNS-only for mail and proxied for www is common. Each hostname still needs a coherent TLS story.
Common multi-domain SSL mistakes
- Cert issued for www only, apex bare domain fails
- HTTP-01 validation blocked because port 80 redirects wrong during renew
- Old expiring cert on one addon domain among twenty (client notices first)
- Wildcard assumed to cover apex when it does not
- Copying one client's vhost SSL config to another client's domain name
Monitoring worth the effort
With many domains, expiry monitoring saves reputation. Uptime tools that check HTTPS per hostname, or centralized cert expiry alerts, beat discovering a red padlock from a client screenshot.
Bottom line
Multiple domains on one server usually means multiple Let's Encrypt certificates via AutoSSL or Certbot, not one magic wildcard for everyone. Wildcards and SAN certs fit specific shapes. Automate renewal, validate DNS before cutover, and monitor expiry across the fleet.
Hosting many domains on Canadian infrastructure and SSL feels messy? Talk with Swift Host. We will align cert strategy with how you add clients and who controls DNS.
