Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have written a small program to run on a Windows computer that serves SSL/TLS web pages through port 443 to visiting web browsers. I want it to be easy for non-technical people to install and run this program. I have made it easy for them to create a self-signed certificate or a certificate signing request in the program, but I think they are going to struggle getting the CSR signed and connected to a domain name which points at their server. I want to reduce the technical difficulty of this process to a minimum.

Can I purchase an SSL certificate which can sign certificates for subdomains of my domain name? Something like customer1.mydomain.com, customer2.mydomain.com etc and then I could point my DNS subdomains at their servers and sign their certificates for them and automate the entire process. Or maybe this would be very expensive?

If not, apart from hosting all their web applications on my own server with a *.mydomain.com certificate, what is the simplest solution I can give them for setting up the SSL certificates and domain names?

share|improve this question
    
Anyone visiting *.mydomain.com would see a cert error in their browser because you're not a registered certificate authority in any browsers. –  gravyface May 28 '11 at 15:53
    
GeoTrust offers GeoRoot so you can become you're own root certificate authority for your domain, but you need to have a net worth of 5M or more and a bunch of other requirements. –  gravyface May 28 '11 at 15:56
    
@Gravyface Do they now? That's new. –  sysadmin1138 May 28 '11 at 16:04
1  
You might have better luck setting yourself up as a reseller and semi-automating the SSL/domain registration process through your account. –  gravyface May 28 '11 at 16:16
    
GeoRoot is not an intermediate CA certificate simply handed out to the customer, it is an external signing service which can be integrated with Active Directory. –  syneticon-dj May 28 '11 at 19:44
show 1 more comment

3 Answers

up vote 1 down vote accepted

StartCom has an Intermediate Certificate Authority program. According to the linked site the program is intended for those issuing 1,000 or more certificates and the average cost is around $2 per issued certificate.

share|improve this answer
    
Thank you. That sounds like it would do what I asked for, but I am not a big company yet. Maybe in the future. I think I will just dump the technical complexity on my customers for now. –  fawltyserver May 29 '11 at 9:46
add comment

The sad truth is that what you aim for is technically possible with the x.509 Name Constraint permittedSubtrees attribute as defined in RFC 2459 Section 4.2.1.11, but you hardly will find any CA willing to provide you with such a certificate.

Some will not do that due to the thought that selling you such a certificate once is not as good as selling you a lot of per-host-certificates many times.

Some will not due to self-incurred braindead regulatory requirements or requirements of external parties.

There is a very very sad story about the certificate chain of a large telecoms provider which has signed intermediate CAs for a national research network which in turn did issue CA certificates to Universities. While this does not sound very sad yet, the sadness starts as a brave man from the aforementioned telecoms provider tried to get the certificate and the trust chain included into Mozilla Firefox - it took 4 years of discussions, reviews, misunderstandings and even more discussions before it was finally included.

What you can purchase is mostly some "Managed Service" where you would use the CA's interfaces to create new certificates more or less at will. Of course, this typically will cost a lot of money beforehand and you likely will be additionally charged for every issued certificate.

share|improve this answer
    
Just as a footnote: the security processes followed by commercial CAs (and thus their customers as well) have been heavily criticized by renowned information security experts as being prone to breakups. All of it still applies. –  syneticon-dj May 28 '11 at 19:52
    
"but you hardly will find any CA willing to provide you with such a certificate" - do you know of any exception? I am looking for such certificate too. Is there a name for "Name Constraint permittedSubtrees" certificates? Though, judging from this thread, this part of RFC never really took off... –  johndodo Aug 8 '12 at 7:17
    
@johndodo I only know of the U.S. Federal Bridge CA as a "public" authority having used name constraints in the past for the subordinate CAs of the U.S. government agencies. I have never seen any of the CAs preinstalled with browsers or operating systems issue such certificates myself. The ones noted in your referenced post - the swiss touring club and the ICC are both issued by WISeKey (a Swiss CA), but I do not know much about their product line. –  syneticon-dj Aug 10 '12 at 11:43
    
As an aside: the EFF's map of CAs makes an interesting reading. –  syneticon-dj Aug 10 '12 at 11:52
add comment

The problem with what you intend is that there is no way for a primary CA (Verisign, Thawte, etc) to constrain a subordinate CA (what you're looking for) to only assign certificates for, or be valid for, a specific domain. A subordinate CA that chains to a valid root will be able to create certificates for the entire Internet. This is why you can't get a Subordinate CA certificate from anyone but a root CA you make yourself.

You can't do what you're looking for without a wildcart certificate from one of the big certificate vendors. Those can be bought, unlike subordinate CA certificates.

share|improve this answer
    
The problem with what you intend is that there is no way : oh yes, there is... Nobody wants to walk it, but that's another problem. –  syneticon-dj May 28 '11 at 19:45
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.