Is it possible to reduce the number of SAN entries in a certificate?

Question

Domain Name System

Good afternoon. We plan to buy a commercial certificate for exchange. At the moment there are 7 domains, all sites with certificates, there is an external IP that resolves mail.domain1 (ptr record). The mail server uses a certificate issued by a domain certification authority, the SAN contains the domains themselves + 7 "autodiscover.domain" + local server name. Is it possible to somehow reduce the number of records using dns, ideally, so that there are only owa.domain1, mail.domain1, autodiscover.domain1?

Answer 1

With a large number of accepted domains, there are only three ways:
1. Constantly add new SAN domains in certificates, as everyone has already explained to you (but with a penny price of a domain, the cost of a certificate grows wildly)
2. Use an SRV record
3. Use the http mechanism -redirect to a single namespace.
Those. you encountered the first case, you already didn’t like it, let’s go to the second.
The second way looks kind of tempting, and the least expensive, but there is a nuance, the first is the slowest way, because. the autodiscover service uses SRV at the very last stage, and worse than that, it may not be supported by some devices, i.e. acceptable only for Outlyuks.
The third way is to use a webserver with a redirect to a single namespace, i.e. when a resource is created on the web server that listens to all endpoints of your autodiscoverer, i.e.:
autodiscover.bank.ru
autodiscover.insurance.ru
autodiscover.shop.ru
, etc.
and sends a 302 redirect to autodiscover.mymail.ru for which you bought a certificate with the required SAN or wildcard *.mymail.ru...
Something like this.

Answer 2

What prevents you from buying a wildcard certificate for domain1?

Answer 3

wildcard is issued for one domain with subdomains. *domain1.ru, I have domain1.ru, domain2.ru, domain3.ru, etc.
How will this help me?

Answer 4

No. For each domain that is used in the mail, you need to have a SAN autodiscover.domain.name - otherwise it will not work - do you think that the registrars just introduced a special type of "certificates for Exchange"? they know about it too ;)