I have a client that wants to use a single Wildcard certificate purchased from a third party CA for the purpose of Server Authentication when connecting to and from AD LDS using SSL and for routing IIS traffic through a load balancer.
So as an example they have server A running AD LDS that they want to connect to using SSL. Rather than issue a certificate to that machine using their domain CA to the proper Fully Qualified Domain Name of the server, they want to use a wildcard cert issued to *.domain.com for the AD LDS server and then use that same cert on servers C,D, and E behind load balancer B for the purposes of doing SSL web traffic to browsers. This is all for an intranet web app I work with.
My contention is that wildcard certs like that are only appropriate for SSL web traffic when you have lots of sub domains to secure like mail.domain.com and sharepoint.domain.com and on and on, and should never be used for things like actual server identification and even the load balancer is inappropriate as a simple Server Alternative Name arrangement will suffice, and that for an internal app, a third party cert is a waste of money since they should simply use an Enterprise CA.
My question is, am I correct or not? If this is a certificate no no, how bad is it? Should I really fight this very hard or let them waste their money on Third party certs?