2

My client has a wildcard certificate *.thierdomain.com that they are using for half a dozen of production web sites.

For each of theses sites there are duplicates in several environments, dev, qa, pre-prod, etc.

Up until now other environments than prod did not have a SSL certificate at all as there were no https specific functionality. So the sites ran only over http (within corporate network) for non-prod, and https only for prod.

Now we are adding some functionality that I'd like to test over both http and https in a single environment.

I would usually use self-signed certs for that, but this client has a wildcard certificate already available. It would be so easy just get this cert installed on other environments web servers.

Are there any negative security implications of that?

7

I would assume that the test/dev environment is more 'open' than Prod, in terms of who can access it with admin privileges, etc. If this is the case, and e.g. the dev team and/or external resources have access to the additional environment then that potentially increases the risk that the private key is compromized.

If this is a concern, I would splurge out and buy $10 SSL certs for each dev/test/etc environment. That way the wildcard prod key stays on prod, and won't have to be revoked+replaced if the key for any reason would fall in the wrong hands...

  • Yep, being exposed a bit wider within the organisation is the only security I can see too. Thank you for your answer. This is not much of a concern for the client. They are not a bank and the application information is sensitive only to a degree. – Andrew Savinykh May 31 '15 at 1:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.