You host multiple IIS sites: contoso.com, app1.contoso.com, app2.contoso.com, and api.contoso.com. You want a single certificate to secure all names and plan to renew it with minimal downtime. What should you do? Choose two actions.

A SAN (Subject Alternative Name) certificate is the most flexible and secure option here. It allows you to explicitly list contoso.com and all specific subdomains (app1.contoso.com, app2.contoso.com, api.contoso.com) under a single certificate. Enabling SNI (Server Name Indication) in IIS bindings allows multiple SSL certificates to be hosted on a single IP address and port, which is crucial when using a SAN certificate for multiple distinct hostnames. For renewal, the best practice is to renew with overlap. This involves importing the new certificate into the server's Personal store before the old one expires. During a planned maintenance window, you then update the IIS HTTPS bindings to point to the new certificate's thumbprint. This minimizes downtime as the old certificate remains active until the binding is switched. A wildcard certificate for .contoso.com would cover app1.contoso.com, app2.contoso.com, and api.contoso.com, but not contoso.com itself, which requires a separate entry or a multi-domain wildcard. Nested wildcards like ..contoso.com are not standard or widely supported. Exporting the old private key and importing it into a new certificate is not a standard or secure renewal process; new certificates should have new private keys.