The time has come for us to renew and update our wildcard certificate. I've been tasked with researching the ways we can protect the private key without compromising the security of the certificate. (With the key and cert together, anyone could impersonate us.)
I understand the pros and cons of using wildcard certs, and this is the direction the IT Director has decided to go.
We're a 99% Windows shop; no configuration management setup. We're likely going to have to touch each machine that uses the wildcard cert.
I know some configuration management tools (like Puppet) have modules that you can use to pass a secured variable instead of a clear text password. Is there a way to install the cert on machines without having to distribute the private key to other team members?
Any thoughts/ideas/best practices would be greatly appreciated.