up vote 1 down vote favorite
1
share [g+] share [fb]

Is there anything inherently more insecure about using a wildcard SSL certificate over a regular SSL certificate?

We are looking to implement a subdomained web application (a la FreshBooks and BaseCamp, where users pick a subdomain), and one of our team members is concerned that a wildcard SSL approach is not secure enough (if so, how do FreshBooks and BaseCamp do it?!?).

The alternate solution is to use a single subdomain, like https://ssl.domain.com and when a user types in http://user.domain.com we set the subdomain in the session, and immediately redirect the user's future requests to "https://ssl.domain.com" and use the session information to show the user's information.

My concern is that if a user wants to send a link to their domain to a friend, they will copy/paste the URL in the browser (now https://ssl.domain.com) which will be our main home page, and not the user's home page.

BTW, if I have missed a major best-practice for this kind of scenario, please let me know.

link|improve this question
feedback

3 Answers

up vote 5 down vote accepted

To my knowledge, there is no difference between wildcard and normal certificates. So long as you have full control over domain.com's DNS, then there's no reason not to use a wildcard. In fact, I would recommend it in your case. What are your specific concerns with them?

(IMO, Redirects such as the one you suggest are always a bit of a fudge when they're visible to the end user.)

link|improve this answer
That's what I thought. Thanks! – iopener Apr 26 '11 at 16:50
feedback
up vote 3 down vote

From a technical aspect it would be just as secure. You would still be using the same encryption you would with a non-wildcard cert. What is it that they are saying is less secure?

link|improve this answer
feedback
up vote 2 down vote

As SmallClanger points out, so long as you have full control over the domain and any possible sub-domains, there's not inherent security problems. One possible drawback is that you can't get a Wildcard EV Cert, so no green bar for the few users that look for it.

link|improve this answer
This is the thing that makes me wonder. If the wildcard won't give us a green bar, and providers consistently offer lower "insurance" payments if compromised (wildcard = $10K, EV = $150K), it seems as though there is something inherently less trustworthy with the wildcard. Is it just that they are more likely to be used on multiple boxes, and therefore pass through many hands, and therefore be more likely to be compromised? – iopener Apr 26 '11 at 16:50
@iopener, yeah, that's basically the train of thought is that wildcard certs are more likely to be on more boxes and you're less likely to be careful with them... Wildcards are also cheaper, hence less insurance as well. – Chris S♦ Apr 26 '11 at 17:33
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.