I have a client that wants to use a single Wildcard certificate purchased from a third party CA for the purpose of Server Authentication when connecting to and from AD LDS using SSL and for routing IIS traffic through a load balancer.

So as an example they have server A running AD LDS that they want to connect to using SSL. Rather than issue a certificate to that machine using their domain CA to the proper Fully Qualified Domain Name of the server, they want to use a wildcard cert issued to *.domain.com for the AD LDS server and then use that same cert on servers C,D, and E behind load balancer B for the purposes of doing SSL web traffic to browsers. This is all for an intranet web app I work with.

My contention is that wildcard certs like that are only appropriate for SSL web traffic when you have lots of sub domains to secure like mail.domain.com and sharepoint.domain.com and on and on, and should never be used for things like actual server identification and even the load balancer is inappropriate as a simple Server Alternative Name arrangement will suffice, and that for an internal app, a third party cert is a waste of money since they should simply use an Enterprise CA.

My question is, am I correct or not? If this is a certificate no no, how bad is it? Should I really fight this very hard or let them waste their money on Third party certs?

Thanks, Bill

  • 1
    Depending on your threat model, Enterprise CA might be much, much more expensive than a wildcard cert. Remember, even for internal use, you have to do your Enterprise CA right or not at all. – schroeder Oct 5 '15 at 23:33
  • Good point. I'd be interested in any links explaining ways Enterprise CA can be done wrong and scenarios where Third Party cert is better in those circumstances. – Bill Hurt Oct 5 '15 at 23:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.