Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We're using a wildcard certificate on several hosts, which right now means that we have to distribute the wildcard cert's private key to each machine, which is a security problem. On the other hand, buying a separate certificate for each new host is way too expensive for us.

Is there a way to not have the private key on each host? Can I myself create a certificate for that specific host and sign it with the wildcard certificate, or something along those lines? How is this normally handled?

share|improve this question
up vote 2 down vote accepted

Most companies will allow unlimited duplicates of a wildcard that use a different csr. Digicert allows unlimited free dupes on their wildcard plus, for example.

You could sign your own certs, but no browsers would have a trust for it so it's a little pointless.

share|improve this answer
But that would still make MITM attacks on all our connections possible if just one host is compromised, right? – futlib Nov 9 '11 at 13:04
Yes. This is the downside with wildcard certificates -- you only have one identity. – David Schwartz Nov 9 '11 at 14:21
Then I fear that wouldn't really win much for us. Not that we like the thought of having to manually request a certificate from a CA for each host, we create new ones all the time. – futlib Nov 9 '11 at 14:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.