2

Suppose, a server hosts

   https://www.master.com/

and thus is equipped with a (single domain) SSL certificate.

Furthermore, suppose there are some web apps below master.com:

   http://wiki.master.com/
   http://docs.master.com/
   http://cal.master.com/
   ...

To protect those web apps, one could use a wildcard certificate for master.com, which reaches 1 level down. This wildcard SSL certificate would thus protect connections to each of these web apps.

Question: Could this wildcard certificate be issued, although another (non-wildcard) certificate for www.master.com has already been issued?

Do CAs exchange data to ensure, that the domains of issued certificates do not overlap?

Improve this question

2 Answers 2

Reset to default
3

Yes. An example:

blog.torproject.org has a non-wildcard cert on 38.229.72.9

www.torproject.org uses *.torproject.org on five apparently-distinct machines 38.229.72.16 38.229.72.14 93.95.227.222 86.59.30.40 82.195.75.101

research.torproject.org uses *.torproject.org on 38.229.72.14

I may be confusing at first to the (rare) people who actually examine the certs, but the user agents don't care.

I can't think of any good reason to have both certs on one server.

I can't imagine any general way that a CA would know if another CA issued an overlapping cert. I seriously doubt that you could get any of them to share information about customers with each other.

Improve this answer
4
  • Actually, in general, there aren't any reasons to have two certs ;-)
    – SteAp
    Commented Sep 8, 2013 at 12:56
  • I just learned that CAs cannot issue wildcard certs with EV. If you want the green bar for one domain, but don't care on the rest, that might be a valid use case. startssl.com/?app=25#87
    – Terrel Shumway
    Commented Sep 12, 2013 at 16:45
  • @teries-riel Thx! Yes, I'm aware of the that wildcard certs can't be EV. In fact, we have to choose between EV or wildcard.
    – SteAp
    Commented Sep 12, 2013 at 21:14
  • @SteAp a very valid reason is that if you have one wildcard certificate and put that on dozens of other peoples computers (cloud hosting) it increases the probability that this certificate gets stolen. If I put my wildcard for *.cia.gov on some box from cheapbackyardhosting.kp and it gets stolen, this is bad. If I put just a certificate for internaltest.cia.gov there, that's less bad.
    – Josef
    Commented Aug 24, 2016 at 15:24
3

Yes, you can issue a wild card certificate for your domains.

No, CAs probably don't exchange data, nor would they care if some other CA purchased an overlapping certificate.

In other words, you can have as many wildcard, and non wildcard certificates as you want. After you acquire the certificate you have to add that certificate into the web server.

Some web servers act funny with overlapping certificates, or may make it hard to distinguish one certificate from another. Just keep this in mind when importing the certificate into your servers and you'll be fine.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .