> obviously a cert that contains SANs for all the sites This is where your example falls apart, because that's not a reasonable thing in the real world. Shared

> obviously a cert that contains SANs for all the sites This is where your example falls apart, because that's not a reasonable thing in the real world. Shared hosts should be (and mostly are) using SNI[1], "Server Name Indication". SNI basically adds "Tell me which certificate you want to see" to the protocol, so your browser starts the request with "I'm trying to connect to Site1", and the shared hosting provider will have certificates for each individual site they're hosting, and pick the right one. For a real example of how this is dangerout, see jsmith45's comment above about wildcards and specific sites. [1] https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication