3

I have HSTS enabled on several domains that I host/maintain, and I'm using free verified certificates from a provider that only allows encryption of the root and one subdomain on the certificate. They will allow multiple certificates to be generated for a given domain; however, all certificates are subject to the root + one subdomain policy.

Are there any security problems with configuring multiple certificates for the host (one for the root + www, and each subdomain will have its own root + subdomain certificate)? I'm especially curious if this would be a problem with HSTS. Wikipedia states that the browser simply a) forces an HTTPS connection, and b) doesn't allow the HTTPS connection to be bypassed, so it would seem to me that this wouldn't be a problem for HSTS.

I know that a setup like this could lead someone to become suspicious of the website, but I use the certificates purely for data encryption--I would use a wildcard self-signed certificate if I didn't host things for others to use.

(I'm holding out until Let's Encrypt releases in September, so I'm not looking to buy a wildcard SSL certificate at the moment.)

3

1) There are no security problems. You only have more private keys, which are secure as long as they are not leaked.

2) With HSTS will be no problem, as long as every subdomain has its own certificate, which is trusted, is not revoked and there is not name mismatch.

  • 1
    Perfect, exactly the information I needed. Thank you! – vaindil Jul 8 '15 at 15:29
  • @vilican "more private keys" why ? – Tom Jul 14 '15 at 11:29
  • @Tom If the only key is compromised, he will have to revoke all certificates. The revoking is not free at all CA´s. So I am assuming that he will use more than one private key. Of course, he can use only one. – Vilican Jul 14 '15 at 14:16
  • @Vilican In this configuration, if one key is compromise, we can assume that all keys are compromised, so in my opinion, having different keys doesn't improve security and add unnecessary complexity. (If using different hosts for different domains, then yes, using different keys makes sense) – Tom Jul 14 '15 at 14:41
  • @Vaindil The only problem about using different certificates are for SNI unaware browsers (but these browsers doesn't know HSTS either so they get a bypassable warning) – Tom Jul 14 '15 at 14:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.