Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have to request a ssl certificate and was told that the host requires a SSL Web Server Cert. I only know of two kinds, SSL domain specific and Wildcard SSL. A long time ago I heard that depending on who gave you the cert it could or could not be used for E-commerce sites. However this is the first time I have Heard of a SSL Web Server certificate. I'm concerned it just a type of product being sold by a vendor

What kind are the real non product names and types of SSL certificates?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Long story short... You're mixing up your apples with your oranges. The subject of a certificate has nothing to do with the key usages of certificate.

Wildcard certificates are certificates where the domain-name has a wild-card (an asterisk) instead of a specific domain name. For example: A certificate that has "*.example.com" as it's subject, would be valid for www.example.com, fish.example.com and even lvl1.lvl2.lvl3.lvl4.example.com. These are much cheaper than buying multiple domain-specific certificates when you have additional sub-domains that you use on the same top-level domain. Unfortunately, if your private key becomes compromised... a hacker could setup anything under your domain and it would appear as valid.

Now, for the key-usage portion of the certificates. Certificates can have very specific usages defined. Different "Certificate Authorities" have some pre-defined certificate templates that assign a set of 'key usages'. For example, a "Secure Web certificate" typically defines that the certificate has the Server Authentication usage and the Client Authentication usage. This means that the web-server should be trusted to handle server/client authentication for the domain defined in the subject of the certificate. (could be a wild-card domain or a specific domain) Other secure services can also use that same certificate as long as it provides the key usages that are required by that service. For example, if you were to setup an XMPP server, you can use that same certificate to securely authenticate your clients for that domain, as XMPP does not need additional key usages to establish a connection.

There are many other potential uses for certificates, such as:

  • Code Signing
  • Secure Email
  • Time Stamping
  • OCSP Signing
  • Encrypting File System
  • IP security tunnel termination
  • IP security user
  • IP security IKE intermediate

Different certificate authorities have different requirements and costs associated with the various certificate usages.

share|improve this answer
    
When looking at a certificate for a specific site is there any way to see the key / usage value? –  QueueHammer Jul 30 '12 at 21:33
    
sure... open the cert directly... and look at the key usages defined in the certificate. (Labeled "Enhanced Key Usage" in the details of the certificate) Additionally, look at the "CN" field(s) in the subject of the certificate to find out which domain-names are valid for that certificate. –  TheCompWiz Jul 30 '12 at 21:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.