I was asked to deliver a signed SSL certificate for an IIS server for a client. I have previously done this for the same client/domain before, so it start to seem like an unnecessary expense to hold multiply certificates for different subdomains.
Godaddy charges around $250 for a single SSL certificate with 5 year duration.
I then started to consider a wildcard certificate, but this seem a bit unsafe as the result of a single compromise would have a worse outcome.
That makes me wonder, why there is nothing called Domain CA?
A Domain CA could be signed by a Root CA, and have the possibility to generate Subdomain certificates?
It seem logical to me, but this does not exist, and I wonder why. Do anyone here with a clearer insight understand why no such thing exists?