Recently, I happened to notice that a site I was looking at had different certificate providers for different subdomains. Whilst looking around, I found that seems to be somewhat common (or at least not rare).

Whilst I understand the logic for having different certificates for different subdomains ( see Why one may want to get different certificates for different subdomains? ) I'm not sure if/why having these issued by different providers would be beneficial.

As an example the certificate for https://community.godaddy.com/s/ is issued by Let's Encrypt, whereas the other subdomains of GoDaddy that I have seen have certificates issued by GoDaddy themselves. This is a particularly interesting example as I'm intrigued as to why GoDaddy, as a root CA would choose to use certificates from a different CA for some of their subdomains.

Are there tangible security benefits to having these certificates issued by different providers, or is this likely a choice based on technologies/platforms used to host or deliver the content on these subdomains?

  • 1
    There might be simply different responsibilities, departments, persons, technologies and processes involved with getting certificates for the various subdomains. In larger organisations this might be an result of historic developments, in smaller organisations there might simple no single process established but everything is done as the responsible person knows best. This is unlikely related to security, at least not for certificates at the same security level (i.e. DV vs. EV). Commented Sep 30, 2022 at 6:11

2 Answers 2

  • One common reason: in larger companies, different departments may operate autonomously from each other. And even after corporate acquisitions/mergers, different IT systems (and processes) may coexist... for a very long time.
  • In IT the motto often is: don't break stuff that ain't broken.
  • As already mentioned, some subdomains may be delegated to third parties. E-mail campaigns are often outsourced. The careers website often points to an external website.
  • For certain websites like the customer-facing corporate site, corporations may require an extended validation certificate, which is more costly but comes with increased vetting. For less critical uses, a free certificate is acceptable therefore it makes sense to have more than one supplier for cost reasons.
  • Some CAs provide extra services like APIs to automate certificate issuance, but not all of them. Again, this is one posible reason for diversifying.

It's often because the subdomain is outsourced to a third-party provider, for better or worse. https://community.godaddy.com/ appears to be outsourced to Salesforce.

I'm not an expert on Salesforce, so this is speculation, but they probably have a Let's Encrypt integration available. It's a little embarrassing, but GoDaddy probably decided it was easier to go with the default SSL setup instead of managing one of their own certificates.

Let's Encrypt isn't the only CA to offer free certificates, or an automated API, but they — and the now-standardized ACME protocol — helped popularize automated, free, large-scale certificate management among software and web services, and they remain a common choice.

Most large CAs now have some kind of ACME support (including GoDaddy, as far as I can tell), and it might be good marketing for all of your services to use your own certificates, but it's probably not always practical. It's probably not good business to limit what software and services you use by what CAs they integrate with. Any certificate will usually work, and most users don't have as sharp an eye for it as you do.

(For that matter, Salesforce probably has multiple CAs as customers! Are they all going to fight to be the default?)

If you look at https://crt.sh/?identity=godaddy.com&exclude=expired&dir=^&sort=1&group=icaid (if the website isn't too slow today), the godaddy.com domain has over 3100 unexpired GoDaddy certificates, 74 from Let's Encrypt, and a handful referencing Salesforce and other cloud and CDN companies.

As a different hypothetical, say you're a dedicated server company. You want a corporate blog. You could host it yourself — hosting is what you do! But you have a small team of sysadmins, and none of them are WordPress experts. Your marketers are already familiar with some popular platforms from their past jobs. And modern capitalism loves outsourcing. It would be easy to pay $xx a month to a blog hosting company, set up a few DNS records and let your employees get back to work on what's important.

But there are a lot of decent server or cloud hosting companies in the world. It's not likely any of the popular blog hosts happen to use your services.

Do you run it yourself? Look for a company that will manage a blog on your hardware? Or bite the bullet, look a bit silly, and sign up with some company that will run it on hardware somewhere else?

Lots of companies choose the last option. DNS providers will outsource to services that use other DNS services. CDN companies will outsource to services that use other CDNs. Sometimes a company that provides email hosting will outsource their own corporate email to Google or Microsoft!

Life goes on (until someone has an outage and business worldwide grinds to a halt for a day).

  • "It's a little embarrassing" -- why? "easier and cheaper to go with the defaults" -- what defaults? "modern capitalism loves outsourcing" -- that's reductive and judgemental. "look a bit silly" -- why would that look silly? You have quite a lot of irrelevant and judgemental distractions to what overwise is a solidly technical answer. And you appear to overlook that running a blog or a forum is far, far more than just "hosting" and it has nothing to do with a "love of outsourcing". It's called "services". You could grow all your own food, but you don't. Do you feel silly?
    – schroeder
    Commented Sep 30, 2022 at 10:15
  • 1
    @schroeder I think it's awkward for a company to say, "You should pay me to do XYZ -- even though I pay someone else to do XYZ." As a prospective customer, I'll wonder if they have no confidence in their own service, and if the other person's service will suit my needs better. If I sold fruit and my office cafeteria included vegetables, that's not very awkward. But if I were a Coca-Cola supplier and my office vending machines sold nothing but Pepsi, well, I wouldn't want to lead prospective customers through that hallway on a tour. Commented Sep 30, 2022 at 10:37
  • False analogy. As I said, it's called services. What GoDaddy does is sell fruit. What Salesforce does is automotive repair. You can't begin to compare the two even though both may use a hosting service at some point in the process.
    – schroeder
    Commented Sep 30, 2022 at 11:46
  • I'm not sure we disagree about very much. Commented Sep 30, 2022 at 12:16
  • Except for what's silly, what's embarrassing, and our opinions about "outsourcing" and the values of capitalism. None of which are material to the topic at hand, which is why I'm suggesting that it is a distraction and irrelevant. Instead of adding things to bring focus to the relevant parts, I'd suggest removing the irrelevant value judgements.
    – schroeder
    Commented Sep 30, 2022 at 12:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .