Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Suppose, a server hosts

and thus is equipped with a (single domain) SSL certificate.

Furthermore, suppose there are some web apps below

To protect those web apps, one could use a wildcard certificate for, which reaches 1 level down. This wildcard SSL certificate would thus protect connections to each of these web apps.

Question: Could this wildcard certificate be issued, although another (non-wildcard) certificate for has already been issued?

Do CAs exchange data to ensure, that the domains of issued certificates do not overlap?

share|improve this question
up vote 3 down vote accepted

Yes. An example: has a non-wildcard cert on uses * on five apparently-distinct machines uses * on

I may be confusing at first to the (rare) people who actually examine the certs, but the user agents don't care.

I can't think of any good reason to have both certs on one server.

I can't imagine any general way that a CA would know if another CA issued an overlapping cert. I seriously doubt that you could get any of them to share information about customers with each other.

share|improve this answer
Actually, in general, there aren't any reasons to have two certs ;-) – SteAp Sep 8 '13 at 12:56
I just learned that CAs cannot issue wildcard certs with EV. If you want the green bar for one domain, but don't care on the rest, that might be a valid use case. – Teris Riel Sep 12 '13 at 16:45
@teries-riel Thx! Yes, I'm aware of the that wildcard certs can't be EV. In fact, we have to choose between EV or wildcard. – SteAp Sep 12 '13 at 21:14

Yes, you can issue a wild card certificate for your domains.

No, CAs probably don't exchange data, nor would they care if some other CA purchased an overlapping certificate.

In other words, you can have as many wildcard, and non wildcard certificates as you want. After you acquire the certificate you have to add that certificate into the web server.

Some web servers act funny with overlapping certificates, or may make it hard to distinguish one certificate from another. Just keep this in mind when importing the certificate into your servers and you'll be fine.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.