Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a security advisor that is telling me that we can't use wildcard SSL certs for security reasons. To be clear I much prefer using single certs or multi-domain certs (SAN). However we have a need for the server (plesk) to server 100s of subdomains.

Based on my research the main reason people site for not using wildcard is the following which appears to come from verisign:

  • Security: If one server or sub-domain is compromised, all sub-domains may be compromised.
  • Management: If the wildcard certificate needs to be revoked, all sub-domains will need a new certificate.
  • Compatibility: Wildcard certificates may not work seamlessly with
    older server-client configurations.
  • Protection: VeriSign Wildcard SSL Certificates are not protected by NetSure extended warranty.

Since the private key, cert, and subdomain will all exist on the same server... replacement would be as simple as replacing this one cert and effect the same amount of users. Therefore is there another reason not to use a wildcard cert?

share|improve this question
    
The line is always grey, but more for your benefit, this might fit really well over on the IT Security SE. Those guys will have some great information too. Just a thought. –  John K Aug 27 '12 at 22:38
    
Can multiple subdomains (hosts in the same domain) share the same IP address when under a wildcard domain? I've never checked that before, but if they can, that would seem to be a justification to use a wildcard cert, to avoid having to use so many IP addresses. Otherwise I see it as saving certificate costs in exchange for disk of exposure (higher if spread over many machines). –  Skaperen Aug 27 '12 at 22:51
    
@Skaperen, yes, with a wildcard certificate, you can host lots of different sites on a single IP. –  Zoredache Aug 27 '12 at 23:10
    
Remember that the IP address does not appear in the SSL certificate. –  Stefan Lasiewski Aug 27 '12 at 23:13
    
The security advisor has relented when I presented my case and he couldn't come up with a good reason to not since we've isolated this down to a single server/service. –  Gray Race Aug 28 '12 at 19:50

2 Answers 2

up vote 5 down vote accepted

The only other 'gotcha' that I'm aware of is that Extended Validation certificates cannot be issued with a wildcard, so it's not an option if you're going for an EV certificate.

In terms of the security, you've hit the nail on the head - a single private key protects all domains that are under the wildcard. So, for instance, if you had a multi-domain SAN cert that covered www.example.com and something.example.com get compromised, only those two domains are at risk for attack with the compromised key.

However, if that same system were instead running a *.example.com cert to handle SSL traffic for www and something subdomains and were compromised, then everything covered by that wildcard is potentially at risk, even services not hosted directly on that server - say, webmail.example.com.

share|improve this answer

Security: If one server or sub-domain is compromised, all sub-domains may be compromised.

If you are using a single web server for your hundreds of virtual hosts then all the private keys would need to be readable by that web server process. If a person can compromise the system to a point were they can read one key/certificate, then they probably already have compromised the system to a point where they can grab all the private keys/certs used by that web server.

The keys are generally stored on the filesystem with privileges that will only permit root to access them. So if your system is rooted, then you probably have lost everything. Doesn't really matter if you have a single cert or many.

Management: If the wildcard certificate needs to be revoked, all sub-domains will need a new certificate.

If you are using a wildcard for *.example.org then you only need to replace a single certificate. If you have a cert for one.example.org, two.example.org, and three.example.org, then you have to replace 3 certificates. So the wildcard certificate is less work. So yes, that cert would be revoked and replaced, but since you only have to replace one instead of hundreds, it should be very easy.

Compatibility: Wildcard certificates may not work seamlessly with older server-client configurations.

Those system almost certainly need to be updated. They are almost certainly have many other vulnerabilities.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.