Search code examples
phphttpsslhttpssubdomain

can website use https and static files on http sub-domain


I want buy ssl license and i have two option. One option support unlimited subdomain ( Wildcard ) and another, not support it. but it's cheaper than Wildcard ssl .

Can my website programming with php and use https protocol and static files like images , css , js , videos on another sub-domain use http protocol ?

Do you think i trouble if do this ?


Solution

  • No, this is not a good idea to use Mixed Content (resources on http, main site on https), and it will be automatically blocked in most browsers, making your page look weird and reduces security.

    You have a few choices as I see it, starting from best+cheapest:

    1. Use a service such as LetsEncrypt to get a free certificate for your subdomain, and use the non-wildcard provider on your main site. Or if you don't need an EV certificate (green company-name), you could just get a LetsEncrypt cert for your main domain as well. You will save money, and it's all secure.

    2. Buy the non-wildcard cert and have all static content on your same domain.

    For both 1 and 2, I would suggest that you support HTTP/2 -- the main reason why people started with using different subdomains for static content is to workaround the connection limiting of HTTP/1.x. With HTTP/2, all content is multiplexed, so there not always a true need for this behavior anymore. In fact, domain sharding might make the performance worse.