Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Suppose, a server hosts

   https://www.master.com/

and thus is equipped with a (single domain) SSL certificate.

Furthermore, suppose there are some web apps below master.com:

   http://wiki.master.com/
   http://docs.master.com/
   http://cal.master.com/
   ...

To protect those web apps, one could use a wildcard certificate for master.com, which reaches 1 level down. This wildcard SSL certificate would thus protect connections to each of these web apps.

Question: Could this wildcard certificate be issued, although another (non-wildcard) certificate for www.master.com has already been issued?

Do CAs exchange data to ensure, that the domains of issued certificates do not overlap?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

Yes. An example:

blog.torproject.org has a non-wildcard cert on 38.229.72.9

www.torproject.org uses *.torproject.org on five apparently-distinct machines 38.229.72.16 38.229.72.14 93.95.227.222 86.59.30.40 82.195.75.101

research.torproject.org uses *.torproject.org on 38.229.72.14

I may be confusing at first to the (rare) people who actually examine the certs, but the user agents don't care.

I can't think of any good reason to have both certs on one server.

I can't imagine any general way that a CA would know if another CA issued an overlapping cert. I seriously doubt that you could get any of them to share information about customers with each other.

share|improve this answer
    
Actually, in general, there aren't any reasons to have two certs ;-) –  SteAp Sep 8 '13 at 12:56
    
I just learned that CAs cannot issue wildcard certs with EV. If you want the green bar for one domain, but don't care on the rest, that might be a valid use case. startssl.com/?app=25#87 –  Teris Riel Sep 12 '13 at 16:45
    
@teries-riel Thx! Yes, I'm aware of the that wildcard certs can't be EV. In fact, we have to choose between EV or wildcard. –  SteAp Sep 12 '13 at 21:14

Yes, you can issue a wild card certificate for your domains.

No, CAs probably don't exchange data, nor would they care if some other CA purchased an overlapping certificate.

In other words, you can have as many wildcard, and non wildcard certificates as you want. After you acquire the certificate you have to add that certificate into the web server.

Some web servers act funny with overlapping certificates, or may make it hard to distinguish one certificate from another. Just keep this in mind when importing the certificate into your servers and you'll be fine.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.