We're using a wildcard certificate on several hosts, which right now means that we have to distribute the wildcard cert's private key to each machine, which is a security problem. On the other hand, buying a separate certificate for each new host is way too expensive for us.
Is there a way to not have the private key on each host? Can I myself create a certificate for that specific host and sign it with the wildcard certificate, or something along those lines? How is this normally handled?