Nginx – Specify a SHA-1 or SHA-2 cert depending on client abilities

You can have more than 1 SSL cert per IP, but you can't have more than 1 SSL cert for each IP:port combination. If you're willing to try to run one of the SSL certificates on a non-standard port (anything but 443) then you can use a single IP address.

You can easily serve up a different SSL certificate on different ports.

It turns out that this can be easily implemented with Elastic Load Balancer. You can redirect port 443 on several elastic load balancer IPs to different ports on your instance.

Someone was kind enough to write a good tutorial, complete with diagrams: http://elwoodicious.com/2009/12/23/using-elb-to-serve-multiple-domains-over-ssl-on-ec2-for-giggles/

The "UCC" cert that you're referring to is a certificate with many names in the SubjectAltName field. Since you already have a wildcard certificate, you may find it to be limiting - how many different domain names are you covering with the wildcard? One advantage of a SAN-based certificate is it can cover multiple domains, but you'll need to enumerate every domain name individually when requesting the certificate rather than allowing a browser to match the wildcard cert.

One of the features of the Certificate Authority system is that things change. Roots expire, new roots come into existence, certificates are revoked, roots go bankrupt after compromises. An update mechanism really needs to be in place to handle these changes.

There is a third option available, and that is to use a different CA that offers 2K certificates signed with an authority that was around 10 years ago. That isn't Verisign, but may be someone like Thawte.

If that proves unworkable, you'll need to go with a blend solution. Provide a test site with the new CA you picked for clients to validate against, and offer plenty of notice that the certificate will change and will break up to 25% of clients. Build as much update documentation as you can think of, and build more as clients run into issues. Stress that updating CA information is something that all systems need to do once in a while, so documenting this is a good thing in the long run; it's a best-practice.