If the hostname is identical—i.e. if the certificate you just purchased was for example.com
and you are setting up your CherryPy app on example.com/store
, then you're good to go. Do not self-sign since the issuing CA you just purchased from went out of their way not to endorse any hostnames other than the one that you paid for (omitting subdomains). If you plan to set it up elsewhere, e.g. store.example.com
, you will need to buy a new certificate for the subdomain. You can use the same certificate on as many machines as you wish (most likely) as long as they are being accessed via the one endorsed hostname. I think your best course of action is to either migrate the website over to your web app VPS like you said, then setup a secondary VPS that is dedicated to routing and signingor use a self-signed certificate for use between the shared host and your main entry point—or use a self-signed certificate for use between the shared host and your main entry point (VPS) only, and in that case a root CA's endorsement is of no consequence because you know you can trust you.
Client ~~ GET https://ex.com/store ~~~> VPS Shared Host
Client VPS ~~ GET https://store.ex.com ~~> Shared Host
Client VPS <~ OK (self-signed cert) ~~~~~~ Shared Host
Client <~ OK (CA-signed cert) ~~~~~~~~~ VPS Shared Host
Something like this, sort of a healthy MITM. If someone requests the web app on the VPS, then the VPS can just respond normally without involving the shared host.
As an aside, these seemingly arbitrary restrictions that you can only lift with a flick of your magic AmEx should not be an issue later on this year.