Creating ssl-certificate for third-party service

Question

I have website e.g. https://mysite.com. I want to connect third-party service to domain https://catalog.mysite.com. This service asked to give them ssl-certificate (.crt + private_key), created on my server, so they could install it on their server.

As I understood, I'll do the following:

1. create key, csr; approve that I'm the domain owner and fetch certificate from issuer;
2. give the .key and .crt to the third-party service (not copy, but erase from my server and give files to the service).
3. point catalog.mysite.com to service's ip.

Looks like simple procedure, but will it somehow compromise my server or mysite.com domain security?

Answer 1

If you create a certificate only for catalog.mysite.com, this won't compromise your security (further). All it allows this third party to do is run their server on the domain "catalog.mysite.com". They obviously can read everything sent to "catalog.mysite.com".

But if I understand you correctly, that is exactly what you want from them.

If you also add "mysite.com", "www.mysite.com" or any other subdomain to the certificate, this third party can also run a server which identifies as "mysite.com".

Some certificate authorities automatically add "mysite.com" to a certificate for "catalog.mysite.com". Don't get a certificate from them.

Answer 2

EDIT: Looks like I interpreted your question wrongly.

If a third-party service is hosting a website for you, then yes, you have to give them the private key of the certificate. However, as pointed out by Josef, you should create a certificate that only covers the minimum necessary, i.e. only for catalog.example.com.

If you give them a certificate for *.example.com, then they can also impersonate other sites in your domain, such as mail.example.com, admin.example.com etc. If this is not what you want, do not give them the technical ability to do that. By giving others a certificate with a private key, you are delegating an authority to represent a part of your domain to them. Only delegate what is necessary and not anything else.

---

Original response:

You never give a private key to anybody! The name has it, it is private!

You generate a self-signed certificate using a pair of public and private key. If they want to verify it's your server, you give others your public key (i.e. the certificate file) through a secure channel. If you want to verify their server, you ask them to provide the public key to you in a secure manner, or have a mutually trusted authority (i.e. CA) sign a certificate to them.