Given a proxy performing MITM SSL decryption and inspection, is it possible to install a wildcard certificate (*.domain.com) on the proxy signed by a root CA (such as VeriSign or GoDaddy) such that clients will not have to have a self-signed cert installed (since they will already trust the root CAs in their trusted store)?

I'm thinking about this in terms of allowing BYOD devices on a network and avoiding the necessity of installing a cert on different device types such as iOS, Android, Windows Phone, etc.

1 Answer 1


This should be possible with certain configurations of proxy servers. Usually SSL proxies are put in place to proxy all outbound traffic, not just traffic to a server that you own, which is why you typically need to install the SSL proxy cert on all devices. If you want to only proxy traffic to one domain for which you have a cert signed by a root authority, then you should be able to install that wildcard cert on the proxy and not need anything from the clients.

  • Kevin, that's exactly what I was looking for. Thanks! Jun 13, 2014 at 16:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .