Manage SSL per domain by matching certificate scope to the hostname, completing domain control checks, redirecting every public variant to HTTPS, and monitoring renewal and mixed-content failures.
Match the certificate to the domain model
For separate root domains, use a certificate whose names cover each root and its required host names. For subdomains under one root, a wildcard certificate can cover the chosen level, while Server Name Indication lets multiple certificates share an IP address. A wildcard does not automatically cover a different root domain or every deeper label, so write down the exact names before requesting it.
Validate domain control
Certificate authorities commonly verify control with an HTTP token or a DNS record. Keep the challenge record on the intended DNS zone, check that authoritative nameservers agree, and remove temporary records after issuance when the authority allows it. A restrictive CAA policy can limit which authorities may issue certificates, but it must be coordinated with the certificate process or issuance will fail.
Redirect without breaking the site
Serve the same canonical content over HTTPS and redirect HTTP with a permanent redirect after the certificate is working. Update canonical links, sitemap entries, image URLs, API endpoints, cookies, and webhooks so they use the HTTPS origin. Check third-party frames and scripts for mixed content. Consider HSTS only after every required subdomain is consistently reachable over HTTPS; a premature policy can make a forgotten host difficult to recover.
Track each renewal
Maintain a domain register with certificate names, issuer, expiry, renewal method, DNS owner, and the responsible person. Test renewal in a non-production environment where possible, and inspect both the served certificate and the chain from more than one network. Watch for an expired certificate, a missing intermediate, a hostname mismatch, or a new domain that was added without a certificate request.
Connect SSL to portfolio isolation
Certificate scope is one part of the architecture decision. A shared account may be efficient for related landers, while resource, client, or reputation boundaries can justify a separate account. The hosting for affiliate sites guide covers wildcard and per-domain economics; review the products page for the current hosting path.