Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a sub domain from I would like to get a free SSL certifcate for my domain. Is this even possible to do for a subdomain and if so what are my options?

share|improve this question

closed as off-topic by random Feb 12 '14 at 22:55

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question is not about computer hardware or software, within the scope defined in the help center." – random
If this question can be reworded to fit the rules in the help center, please edit the question.

Can you clarify what you mean by a "sub domain"? Do you mean something like "" that's registered to you and owned by you? Or do you mean something like "", where someone else owns "" and lets you have use "moose" without actually owning anything? If the former, you can get free SSL certificates. If the latter, you probably can't get them at any price. (Since you don't own anything and SSL certificates prove ownership.) – David Schwartz May 29 '12 at 6:13
its the latter. – Sab May 29 '12 at 6:32
Then you need to get a "real" domain and use a CNAME entry to point it to the "borrowed" domain. Then you can get a free SSL certificate for the "real" domain -- since you can prove you own it. – David Schwartz May 29 '12 at 6:52
Actually, StartCom will issue a certificate under these circumstances so long as the domain owner submits an authorization letter that they can verify. – David Schwartz May 29 '12 at 8:00
@DavidSchwartz And how exactly are you supposed to get a provider such as to fill out such a letter for you? (Also, StartCom won't do this for the level1 [free] cert) – Michael Dec 31 '14 at 18:25
up vote 9 down vote accepted

There are at least three options for using a certificate with a web or mail server:

Option 1: Obtain an SSL certificate signed by a certificate authority (CA)

The advantage of using a certificate signed by a CA is that your visitors will automatically trust your certificate. Operating systems and web browsers ship with a list of trusted root certificates, and only certificates signed by those trusted certificates are considered trusted by default.

The disadvantage, of course, is that to my knowledge all the CAs included with major operating systems and browsers charge money for their services.

CAs do offer certificates for subdomains; however, they generally have some sort of simple verification process to prove you have control of that subdomain. Different CAs may have different policies about issuing certs for subdomains of and other dynamic DNS providers.

A small list of potential CAs you might investigate are:

Option 2: Obtain an SSL certificate from a web-of-trust provider

The only web-of-trust provider I'm aware of is This is a certificate authority that provides free SSL certificates. However, the certificates do not verify anything about your domain until enough other users have verified your identity. Once you've earned enough "assurance points", you can add a name to your certificate and have longer expiration dates.

However, I don't believe's root certificate is included in most browsers by default. Your visitors will need to install this root certificate or else they'll get the Scary Certificate Warning:

Untrusted certificate error

Option 3: Generate a self-signed certificate

If you really cannot purchase a certificate, you can create a self-signed certificate. This doesn't require any CA, but others computers will not automatically trust your certificate. Guests visiting a website secured by a self-signed certificate will receive the Scary Certificate Warning.

Depending on your system, there are different ways to do this. If you are using OpenSSL, you can use the instructions provided by

# Generate a private key
openssl genrsa -des3 -out server.key 1024

# Generate a certificate signing request (CSR)
openssl req -new -key server.key -out server.csr

# Generate the self-signed certificate
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

You would then install server.cst in your web server of choice.

share|improve this answer
So are there no free ssl certifiactes for subdomains – Sab May 29 '12 at 5:18
@Sab: Self-signing a certificate is free, but isn't trusted by browsers by default. This is a trade-off you must make. A CA getting their root certificate included with browsers is expensive; I'm not aware of any who bear that cost without charging customers for that service. – Stephen Jennings May 29 '12 at 5:27
Okay. I guess i have to figure some other way. – Sab May 29 '12 at 5:53

You can get a free certificate for subdomains for 90 days from Comodo SSL. This is the only one I've found that is provided by a ubiquitously trusted certificate authority, free, and valid for subdomains. I've personally used it with my free domain provided by no-ip. Unfortunately it's only valid for 90 days, after that it's $100/year (or less for a multi-year commitment).

share|improve this answer
When I try this approach, it tells me that an account already exists for the domain above mine (e.g. I try to send a CSR for, which I own, and it tells me an account already exists for, which I do NOT own.) – Michael Dec 31 '14 at 18:33

Not the answer you're looking for? Browse other questions tagged or ask your own question.