My client has a wildcard certificate *.thierdomain.com that they are using for half a dozen of production web sites.

For each of theses sites there are duplicates in several environments, dev, qa, pre-prod, etc.

Up until now other environments than prod did not have a SSL certificate at all as there were no https specific functionality. So the sites ran only over http (within corporate network) for non-prod, and https only for prod.

Now we are adding some functionality that I'd like to test over both http and https in a single environment.

I would usually use self-signed certs for that, but this client has a wildcard certificate already available. It would be so easy just get this cert installed on other environments web servers.

Are there any negative security implications of that?

2 Answers 2


I would assume that the test/dev environment is more 'open' than Prod, in terms of who can access it with admin privileges, etc. If this is the case, and e.g. the dev team and/or external resources have access to the additional environment then that potentially increases the risk that the private key is compromized.

If this is a concern, I would splurge out and buy $10 SSL certs for each dev/test/etc environment. That way the wildcard prod key stays on prod, and won't have to be revoked+replaced if the key for any reason would fall in the wrong hands...

  • Yep, being exposed a bit wider within the organisation is the only security I can see too. Thank you for your answer. This is not much of a concern for the client. They are not a bank and the application information is sensitive only to a degree. May 31, 2015 at 1:57

The risk is not the certificate. The certificate is public. The risk is that you need the private key to be spread across a number of environments.

Since it is a wildcard certificate, anyone that has that private key can masquerade as any hostname on that domain.

  • Thank you for the answer to this 7 years old question with an accepted answer, however I find it somewhat obvious. It is apparent that you cannot use a certificate for signing if you do not have access to the private key, everyone who has installed a cert knows this. This was implied in the question. May be this clarification will be useful for others. Feb 11 at 6:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.