title: SSL and authentication across multiple domains
body: <p>I am building an app with Ruby on Rails which allows users to sign up and create their own subdomain:</p>
  
  <pre><code>joebloggs.myapp.com
  </code></pre>
  
  <p>So at the very least I need a wildcard SSL certificate to handle when users are passing sensitive data (authentication, payment etc).</p>
  
  <p>In addition, we are allowing users who want to, to map their own domain to their account, like:</p>
  
  <pre><code>www.joebloggs.com
  </code></pre>
  
  <p>Which all of a sudden creates a massive headache. I'm assuming no SSL product exists to serve this purpose (ie, potentially be used over unlimited domains)?</p>
  
  <p>The app is essentially a CMS, so it has a public facing website, and a admin back end. It is essential that the public facing website side of things has the facility to be mapped to the user's domain. However, I'm less concerned about the admin area and would quite happily force users to log in and administer their site via their subdomain.</p>
  
  <p>However, whilst for the majority of the website it does't really matter whether the user is logged in or not, I DO want to be able to know whether the user is logged in so I can serve up slightly different content to logged in users. I'm assuming this is going to cause me a problem because the cookie can't be used over multiple domains (or can it?). I'm using Authlogic for authentication.</p>
  
  <p>So really, I'm just wondering if anyone has come across a situation like this before? If so, what approach have you taken to get round the several issues here?</p>