5

My client has a wildcard certificate *.thierdomain.com that they are using for half a dozen of production web sites.

For each of theses sites there are duplicates in several environments, dev, qa, pre-prod, etc.

Up until now other environments than prod did not have a SSL certificate at all as there were no https specific functionality. So the sites ran only over http (within corporate network) for non-prod, and https only for prod.

Now we are adding some functionality that I'd like to test over both http and https in a single environment.

I would usually use self-signed certs for that, but this client has a wildcard certificate already available. It would be so easy just get this cert installed on other environments web servers.

Are there any negative security implications of that?

Improve this question

2 Answers 2

Reset to default
9

I would assume that the test/dev environment is more 'open' than Prod, in terms of who can access it with admin privileges, etc. If this is the case, and e.g. the dev team and/or external resources have access to the additional environment then that potentially increases the risk that the private key is compromized.

If this is a concern, I would splurge out and buy $10 SSL certs for each dev/test/etc environment. That way the wildcard prod key stays on prod, and won't have to be revoked+replaced if the key for any reason would fall in the wrong hands...

Improve this answer
1
  • Yep, being exposed a bit wider within the organisation is the only security I can see too. Thank you for your answer. This is not much of a concern for the client. They are not a bank and the application information is sensitive only to a degree.
    – Andrew Savinykh
    Commented May 31, 2015 at 1:57
2

The risk is not the certificate. The certificate is public. The risk is that you need the private key to be spread across a number of environments.

Since it is a wildcard certificate, anyone that has that private key can masquerade as any hostname on that domain.

Improve this answer
1
  • Thank you for the answer to this 7 years old question with an accepted answer, however I find it somewhat obvious. It is apparent that you cannot use a certificate for signing if you do not have access to the private key, everyone who has installed a cert knows this. This was implied in the question. May be this clarification will be useful for others.
    – Andrew Savinykh
    Commented Feb 11, 2022 at 6:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .