Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

i had an interesting conversation with a bank IT security employee, and they raised a few questions.

What is the maximum strength/bit length of a wildcard domain certificate?

Are they as secure? (in the encryption sense)

share|improve this question
up vote 7 down vote accepted

You can make certificates pretty strong, however not all browsers support encryption that strong. 16384 bits is valid, though getting a commercial certificate authority to issue one is another matter.

Fundamentally, wildcart certs are no different than non-wildcard certs from a technical point of view; they just have a "*." in their subject line.


Based on your comment, the bank person you were talking to is of the opinion that the stream cipher is restricted to 40-bit for wildcard certificates. This is not the case. My old job uses a wildcard certificate for most of their web-presences, and a little work with openssl shows that the cipher on those certs is "RC4-MD5" which is a 128-bit cipher.

The 40-bit limit may have been a limit with other SSL suites in webservers, browsers, or certificate-authority infrastructures, but is no longer a limit.

share|improve this answer
Some additional info: you can make key sizes as large as the signing CA will allow. Most these will allow a max of 4096 bit keys. – bahamat Jul 11 '11 at 1:38
I understand this - thanks for the reply. The bank security guy in question informed us we couldn't have a wildcard SSL certificate because they didn't allow a bit length of greater than 40-bit... ? (which was the first i'd heard of it and obviously the reason i asked this question) – Doug Jul 11 '11 at 1:47
40-bit is a stream cypher, and a rather weak one at that. I'm sure this guy is confused. The certs issued by CAs are public/private keys, they're very long, typically the shortest would be 512-bits long. The public/private keys (certificates) are used to determine a session symmetric key (for the stream cypher, which will be used to actually encrypt data during the session). Stream cyphers - like AES, Blowfish, RC4, 3DES - use much shorter key lengths from 40-bits up to 512-bits. Typically 128 or 256 are used these days. – Chris S Jul 11 '11 at 2:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.