Authorised partner · 10-day money back · Free installation support

Devices & Servers · NAS, hypervisors & management consoles

Clear the certificate warnings off every console in the rack

Every console in the rack — ESXi, iDRAC, iLO, the NAS, the switch — throws a certificate warning, and your team has learned to click straight past all of them.

  • The warning they ignore daily is the one that mattersA rack full of self-signed consoles teaches everyone that certificate errors are normal. That habit follows them out of the rack and onto everything else.
  • One wildcard covers the whole rackesxi01, idrac02, nas, switch-mgmt and the rest — every console under one domain, one certificate file, one expiry date.
  • Consoles never have to face the internetValidation over a DNS record means a management interface stays exactly as unreachable as it is today and still gets a publicly trusted certificate.
  • Backup and sync clients stop refusing to connectNAS sync agents, backup software and mobile apps frequently reject a self-signed certificate outright rather than prompting anyone about it.
  • $121.98for a year, Comodo PositiveSSL...
  • 25% offits list price of $162.64
  • DNS validatedconsoles never face the internet
  • One fileevery console in the rack

Start with the box that is warning at you

All of these accept an ordinary publicly trusted certificate. Most of them will also accept the same one, which is the point of the first option below.

One box, or the whole rack?

Management consoles multiply faster than anything else in a data centre, which is why the wildcard is first on this list rather than last.

1

A rack of consoles under one domain

Forty iLO cards, a dozen iDRACs, the hypervisors and the switch UIs all take the same certificate if they share a domain. Buy one wildcard, push the same file to every card, and every new server you rack this year is already covered.

Typically: ilo01, idrac02, esxi03, pve, ups, sw01 — all under acme.com.

Best for this COMODO

Comodo PositiveSSL Wildcard Certificate

Unlimited subdomains of one domain, issued in minutes. The cheapest way by far to cover a rack, and new hardware needs no new order.

  • Domain validated · issued in minutes
  • Covers unlimited subdomains of the domain
  • $10,000 warranty
  • Free unlimited reissues for the whole term
from $121.98 $162.64 per year, before term discounts
Details
Also fine COMODO

Comodo EssentialSSL Wildcard Certificate

The same wildcard coverage under the EssentialSSL brand. Compare the two on the term you want.

  • Domain validated · issued immediately
  • Covers unlimited subdomains of the domain
  • $10,000 warranty
from $131.61 $175.48 per year, before term discounts
Details
2

One NAS or one console

A single Synology, one QNAP or one vCenter that everyone logs into. One name, one certificate, issued in minutes, and the warning your team has been clicking through for two years is gone.

Typically: A single appliance on one public hostname.

Best for this COMODO

Comodo PositiveSSL Certificate

One hostname, publicly trusted, issued in minutes. Uploads straight into DSM, QTS or vCenter.

  • Domain validated · issued in minutes
  • $10,000 warranty
  • Free unlimited reissues for the whole term
from $14.99 $49 per year, before term discounts
Details
Also fine RAPIDSSL

RapidSSL Certificate

The same single-name coverage on the RapidSSL root.

  • Domain validated · issued in minutes
  • $10,000 warranty
  • Free unlimited reissues for the whole term
from $16.95 $69 per year, before term discounts
Details
3

IP cameras, NVRs and DVRs

Camera and recorder web interfaces are usually the last thing to get a certificate and the first thing an auditor asks about. This is the same technology as the options above, packaged for exactly this case.

Typically: Hikvision, Dahua, Axis, Reolink, Uniview and generic NVR web UIs.

Purpose-built SECTIGO

SSL Certificate for CCTV camera or IP camera or IP DVR

Sold specifically for camera, NVR and DVR interfaces, so the guidance that comes with it is written for that firmware rather than for a web server.

  • Domain validated · issued in minutes
  • $10,000 warranty
  • Free unlimited reissues for the whole term
from $69 $99 per year, before term discounts
Details
Cheapest route COMODO

Comodo PositiveSSL Certificate

A standard single-name certificate does the identical job if you are comfortable installing it on the recorder yourself.

  • Domain validated · issued in minutes
  • $10,000 warranty
  • Free unlimited reissues for the whole term
from $14.99 $49 per year, before term discounts
Details
4

Hosts spread across more than one domain

Data centres inherited from acquisitions, or a managed estate covering several customers, will not fit under one wildcard. A multi-domain certificate lists each name explicitly and consolidates the renewal.

Typically: Consoles under two or more registered domains.

Best for a fixed list COMODO

Comodo PositiveSSL Multi-Domain Certificate

Starts with three names and takes many more. Ideal when you know exactly which consoles you are covering.

  • Domain validated · issued in minutes
  • 3 hostnames included, up to 247 in total
  • $10,000 warranty
  • Free unlimited reissues for the whole term
from $114 $165 per year, before term discounts
Details
If each domain keeps growing COMODO

PositiveSSL Multi-Domain Wildcard SSL Certificate

Several domains plus unlimited subdomains under each, so new hardware under any of them is covered without a reissue.

  • Domain validated · issued in minutes
  • Covers unlimited subdomains of the domain
  • 3 hostnames included, up to 247 in total
  • $10,000 warranty
  • Free unlimited reissues for the whole term
from $267.24 $356.32 per year, before term discounts
Details

Worth knowing before you order

Synology and QNAP will fetch a free certificate — when they can

Both have built-in Let’s Encrypt clients, and if your NAS is internet-facing on port 80 and you are happy renewing every 90 days, use them. The reason people buy instead is that most NAS boxes are deliberately not internet-facing, which is exactly the case the built-in client cannot handle. A purchased certificate is validated over DNS and installed by hand, so the box never has to be exposed.

iLO, iDRAC and IPMI want the request generated on the card

Generate the signing request from within the management controller so the private key never leaves it. Older firmware can be fussy — some will only accept a 2048-bit key, and some will not import a chain in one paste and want the intermediates loaded separately. Check the firmware notes before you order a longer key.

Internal-only names still cannot be certified

esxi01.local, nas or 192.168.1.50 cannot appear on any publicly trusted certificate. Give each console a name under a domain you own and resolve it internally with split-horizon DNS. The consoles stay on the management network; only the name is public.

Questions we get asked about this

My NAS offers a free certificate. Why would I buy one?

If it can reach the internet on port 80 and renew itself every 90 days, you probably should not. Buy one when the box is on an isolated management network, when you want a one-year cycle instead of a quarterly one, or when a single certificate has to cover a whole rack of consoles that are not individually internet-facing.

Can one wildcard really cover forty iLO cards?

Yes, provided they all sit under the same domain. You install the identical certificate and key on every card. There is no per-device charge on the products recommended above.

Will this fix the vCenter and ESXi warnings?

Yes, once the certificate and the full intermediate chain are installed and the hostname matches. vCenter in particular is strict about the chain, so verify with the SSL Checker afterwards.

The cameras are behind NAT and unreachable. Does that matter?

Not at all. Validation is done against your public DNS, not against the device. The camera can sit on a private VLAN with no route to the internet and still present a publicly trusted certificate.

Something else on the network?

The same certificates cover the rest of the estate. These pages start from the hardware rather than from the certificate.

Send us the hostname list and we will price it up

Tell us what each box is and which names it answers on. We come back with the cheapest combination that genuinely covers the estate — and say so if that is fewer certificates than you were about to buy.

Ask an engineer Have us install it