Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Let's say I have a certificate that is valid for (and backed by a known SSL vendor). I want to be able to have a test version of the domain,, that is also secured with an SSL certificate, but I'd like to do so without paying for a commercial certificate (I realize there are "free" certificates but nearly all of them come with time limitations, which doesn't work for me).

It's apparently possible to create a chained certificate off of that certificate. What I'm wondering is whether browsers will recognize that chained certificate as valid.

Note that the certificate for is an SAN certificate and covers other domains like,, etc.

Ideally I would like the chained certificate to also be an SAN certificate, and just provide test analogs of each domain:,,, etc.

I'm aware I'll need a separate IP address for the test certificate.

This is on Apache and CentOS, by the way.

share|improve this question
You can perhaps hire the NSA to use top-flight mathematicians to invent new science and engineer a hash collision attack on the CA. Alternatively, you can buy a wildcard cert. – cjc Jul 6 '12 at 22:26
A wildcard would not be sufficient. Sounds like I either create a self-signed CA certificate or buy another SAN certificate. – Jordan Reiter Jul 7 '12 at 17:41
up vote 6 down vote accepted

What I'm wondering is whether browsers will recognize that chained certificate as valid.

None of them. Within your certificate, it has the entry under Certificate Basic Constraints:

Not Critical
Is not a Certification Authority

Once the browser sees that as an intermediate certificate, it'll reject the ones you 'sign' it with.

share|improve this answer

You cannot issue more certificates off of your certificate. Check its x509 Basic Constraints field. Every certificate that a trusted CA issues to a client should always have the CA:FALSE constraint (though recently, a major CA admitted to issuing a certificate to a client with this restriction removed).

If you need to test with certificates that you craft, you'll need to make your own CA and trust it in the client browsers.

share|improve this answer

If you have bought your certificate already then tough luck. If not, look at buying either a wildcard or putting Subject Alternative Name attribute in the CSR. Most CAs will happily sign it without charging you extra.

share|improve this answer
Note that the certificate I bought is great and perfect for my normal needs and needs no adjustment. I just need to either create a self-signed certificate or buy another SAN certificate (I'll probably go with the former). – Jordan Reiter Jul 7 '12 at 17:43
Well, you asked for a cert that is recognized by browsers. Self-signed one is certainly not. – Aleksandar Ivanisevic Jul 8 '12 at 19:10
Yeah, I'll just have to tell all my testers to install the CA. Would have been nice to skip that step. – Jordan Reiter Jul 9 '12 at 22:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.