3

I have HSTS enabled on several domains that I host/maintain, and I'm using free verified certificates from a provider that only allows encryption of the root and one subdomain on the certificate. They will allow multiple certificates to be generated for a given domain; however, all certificates are subject to the root + one subdomain policy.

Are there any security problems with configuring multiple certificates for the host (one for the root + www, and each subdomain will have its own root + subdomain certificate)? I'm especially curious if this would be a problem with HSTS. Wikipedia states that the browser simply a) forces an HTTPS connection, and b) doesn't allow the HTTPS connection to be bypassed, so it would seem to me that this wouldn't be a problem for HSTS.

I know that a setup like this could lead someone to become suspicious of the website, but I use the certificates purely for data encryption--I would use a wildcard self-signed certificate if I didn't host things for others to use.

(I'm holding out until Let's Encrypt releases in September, so I'm not looking to buy a wildcard SSL certificate at the moment.)

Improve this question

1 Answer 1

Reset to default
3

1) There are no security problems. You only have more private keys, which are secure as long as they are not leaked.

2) With HSTS will be no problem, as long as every subdomain has its own certificate, which is trusted, is not revoked and there is not name mismatch.

Improve this answer
5
  • 1
    Perfect, exactly the information I needed. Thank you!
    – vaindil
    Jul 8, 2015 at 15:29
  • @vilican "more private keys" why ?
    – Tom
    Jul 14, 2015 at 11:29
  • @Tom If the only key is compromised, he will have to revoke all certificates. The revoking is not free at all CA´s. So I am assuming that he will use more than one private key. Of course, he can use only one.
    – Vilican
    Jul 14, 2015 at 14:16
  • 1
    @Vilican In this configuration, if one key is compromise, we can assume that all keys are compromised, so in my opinion, having different keys doesn't improve security and add unnecessary complexity. (If using different hosts for different domains, then yes, using different keys makes sense)
    – Tom
    Jul 14, 2015 at 14:41
  • @Vaindil The only problem about using different certificates are for SNI unaware browsers (but these browsers doesn't know HSTS either so they get a bypassable warning)
    – Tom
    Jul 14, 2015 at 14:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .