Unified Communications Certificate (SANS UCC Certificate)

Revision as of 17:24, 17 December 2014 by Teodor Vizirov (talk | contribs) (What is a SAN UCC certificate?)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)

Unified Communications Certificate

-- 1. A Unified Communications Certificate (UCC) is an SSL certificate that secures multiple domain names and multiple host names within a domain name. A UCC lets you secure a primary domain name and additional Subject Alternative Names* (SANs) in a single certificate.

For example, with a UCC certificate you can secure:

  • www.example.com
  • www.example1.com
  • www.example2.net
  • mail.example.net

-- 2. The difference between UCC and Wildcard certificate is that a wildcard certificate can protect all first-level sub-domains on an entire domain, such as *.example.com. But a wildcard cannot protect both www.example.com and www.example.org.

-- 3. How to check the Subject Alternative Names:

When we create a csr, we specify the names of the servers we would like this certificate to cover:

  1. /opt/zimbra/bin/zmcertmgr createcsr self -new -subjectAltNames "one.example.com,two.example.com"

Using an openssl command, we can see the names listed there:

  1. openssl req -text -noout -in /opt/zimbra/ssl/zimbra/server/server.csr

Certificate Request:

       Version: 0 (0x0)
       Subject: C=US, ST=N/A, L=N/A, O=Zimbra Collaboration Server, OU=Zimbra Collaboration Server, CN=one.example.com
       Subject Public Key Info:
           Public Key Algorithm: rsaEncryption
               Public-Key: (2048 bit)
               Exponent: 65537 (0x10001)
       Requested Extensions:
           X509v3 Basic Constraints:
           X509v3 Key Usage:
               Digital Signature, Non Repudiation, Key Encipherment
           X509v3 Subject Alternative Name:
               DNS:one.domain.com, DNS:one.example.com, DNS:two.example.com
   Signature Algorithm: sha256WithRSAEncryption

If in doubt, the above example will hep you check the csr and possibly give you a hint.

SAN: Subject Alternative Names allow you to specify a list of host names to be protected by a single SSL certificate.

Jump to: navigation, search