4

Suppose I purchase contoso.com from GoDaddy and also purchase a wildcard SSL certificate for *.contoso.com from GoDaddy. I now have a web server on xyz.contoso.com that I can secure with HTTPS using this certificate. Good!

Suppose I also have another website hosted on another server, that is not part of this contoso.com domain (or any domain), can I still use the same wild card certificate for this server, provided I take care of DNS to redirect abc.contoso.com to the IP address of this server ?

I think there are ways in different hosting providers to achieve this by paying for static public IP addresses, correct me if I'm wrong.

If this is possible, then am I just violating the licensing agreements of the SSL certificate as it was intended for one purpose but I'm using it for another (since I'm using it on a different domain) ?
The user is under the assumption that he is accessing some resource within contoso.com, while he is actually hitting a server that is not in contoso.com, but is owned by the same person as the owner of contoso.com.

5

I gather you intend to use a wildcard cert for *.mydomain.com across two servers with two public IPs and two different subdomains under the same domain name. This is a common scenario.

Provided that:

  • The wildcard cert is appropriate for the new server. Which it seems like it is, given that both will share the xyz.mydomain.com convention and this very cert is working properly in your existing server.
  • You provision the DNS entries to balance the queries as desired (you seem to already have taken that into consideration).

There seems to be no technical impediment for your certificates to work and be accepted.

However, consult your issuer's terms of service to rule out acceptable use policy issues. Wildcard certs are designed for just such a use case, however every vendor can enforce their own terms of service. A quick email to their support should solve this aspect.

  • I don't think I need SAN certificates or additional subject names to be included in the certificate, as I'll be accessing the other server using the same *.contoso.com domain (URL) for which the certificate was issued. It's just that this server is not actually part of that domain, and I'm using my DNS records to point to the IP of this server from *.contoso.com. Does that make sense? – Nithish Inpursuit Ofhappiness Aug 22 '16 at 21:38
  • Let me know if I have interpreted your query correctly now. Corrections/additions welcome. – dotproi Aug 22 '16 at 21:53
  • I am accepting your answer as it does indeed answer my question. But if anyone has any further insights into examples of such terms of service wherein this is not right, please share the same :) – Nithish Inpursuit Ofhappiness Aug 22 '16 at 22:21
  • I actually did some digging into precisely that and found sentences like "unlimited subdomains" etc.. However, fine print might contradict this broad commercial statement enforcing limitations on where you are hosting the wildcard cert etc.. My thinking is that if you intend to deploy this cert outside of GDs infrastructure (say.. another VPS you may have commisioned), a quick email will provide you with written peace of mind. – dotproi Aug 22 '16 at 22:23
0

Technically, you can only secure a single domain and its unlimited sub-domains using a Wildcard SSL Certificate.

When you generate your SSL Certificate and CSR, you were asked to add the domain name for which you need that wildcard cert.

As per SSL's terms and condition you can not change that domain name. You either need to cancel that certificate and issuer another one (only if it comes under money back guarantee period).

There is another real world solution to secure multiple domains and sub-domains under single certificate. And that is "Comodo Multi Domain Wildcard Certificate".

This allows you to secure up to 100 multiple domains and their sub-domains.

So, if you really wish to secure multiple domains and sub-domains under single certificate, this is a better option.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.