UCC证书只适用于相关网站？
在 SSL 证书提供商上，我收到以下消息：
注意：UCC 证书非常适合通信服务器、Exchange 服务器和其他企业应用程序，以及具有许多相关 URL 的单个公司或实体。 不建议将此证书用于彼此完全独立的网站（例如为竞争对手构建网站的网络提供商）。
我只是不明白为什么。
有人可以分享一些光吗？
先感谢您。
On a SSL certificate provider I get this message:
NOTE: The UCC Certificate is ideal for Communication Server, Exchange Server and other Enterprise Applications, as well as for single companies or entities with many related URLs. This Certificate is not recommended for use with sites completely separate from each other (e.g. a network provider who builds Web sites for competitors).
I just don't get why.
Can anyone share some light?
Thank you in advance.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
由于对
companyA.com和companyB.com都有效的证书只有一个匹配的私钥，因此控制该私钥的人都可以通过以下方式提供任一主机名：就证书验证而言是有效的。这意味着
companyA.com的服务器管理员也有责任保管companyB.com的密钥+证书（因为它是相同的证书）。如果两个公司或站点属于同一实体，则这种方法可以正常工作，但如果这些站点不属于同一管理域的范围，则从组织和法律的角度来看，这可能会变得相当复杂。这通常不利于安全的问责和管理方面。
Since a certificate valid for both
companyA.comandcompanyB.comonly has one matching private key, whoever has control of that private key can serve either host names in a way that is valid, as far as certificate validation is concerned.This means that the server admins of
companyA.comalso have the responsibility for the safe-keeping of the key+cert forcompanyB.com(since it's the same certificate).This can work fine if the two companies or sites are part of the same entity, but this can get quite complicated from an organisational and legal point of view if the sites are not meant to fall within the scope of the same administrative domain. This is generally not good for the accountability and administrative aspects of security.
原因是 UCC 证书只有一个公用名，而所有 SAN（证书上的其余域）始终指向同一个公用名。许多浏览器都可以让您轻松获取此信息，各种在线工具也是如此，例如 http:// www.sslshopper.com/ssl-checker.html 不建议这样做，因为它暗示了业务之间的关联，或者可能会因为域名不匹配而误导消费者。它破坏了 SSL 旨在激发的信心水平，尽管它的安全性和技术可行性同样不低。
举一个奇怪的例子，假设我经营一家名为 IntimateHosting.com 的公司，我专门从事与床有关的任何事情的托管。我是一个床迷。床品店、性玩具店、酒店、床品店早餐、床单制造商等。我为所有这些都获得一份 UCC。一位购物者在 LuxuryHotelA.com 上，想要检查安全性，结果发现通用名称是 FeatherFetish.com（我们的羽绒被销售网站......恰好是我们建立的第一个网站，所以它是通用名称） 。进一步观察，他们看到证书上的其他替代名称包括 LuckyLinens.com、LuxuryHotelB.com（直接竞争对手！）、我们为其提供免费 SSL 的一些破旧无名汽车旅馆，当然还有我们自己的名称 IntimateHosting.com。
诚然，大多数人在购物时不会进行大量研究，但这就是“不推荐”的原因。
The reason for this is because a UCC certificate has only one common name, and all the SAN's (the rest of the domains on the certificate) always point back to the same common name. Many browsers makes this information readily available to you, as do a variety of online tools such as http://www.sslshopper.com/ssl-checker.html It is not recommended because it implies an association between business, or can look misleading to a consumer, because the domain names don't match up. It undermines the level of confidence SSL is meant to inspire, even though it is no less secure and no less technically feasible a setup.
As an outlandish example, lets say I run a business called IntimateHosting.com, and I specialize in hosting for anything to do with beds. I am a bed fanatic. Bed stores, sex toy shops, hotels, bed & breakfasts, sheet manufacturers, etc. I get one UCC for all of them. A shopper is on LuxuryHotelA.com, wants to check the security, turns out the common name is FeatherFetish.com (our down comforter sales site...just happened to be the first site we set up, so it is the common name). Looking further, they see other alternate names on the certificate are LuckyLinens.com, LuxuryHotelB.com (a direct competitor!), some seedy no name motel that we gave a free SSL to, and of course our own name, IntimateHosting.com.
Granted, most people don't do this amount of research when they shop, but this is why it is "not recommended".