Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Caveat: I'm a developer by trade (so please use small words).

A vendor hosts a secure site for us that is branded with our name/domain, orders.oursite.com. Since original setup we've purchased a wildcard cert for *.oursite.com. As I understand it, the basic process for renewing the cert is:

  1. Vendor generates CSR from each server.
  2. We receive a cert based on each CSR for each server from our certification authority.
  3. Vendor installs each cert.

Our vendor (we are an IIS shop/they use Apache) is telling us that we must buy (renew) the specific orders.oursite.com and they can't install a cert that's been generated against *.oursite.com. Is there any truth to this that my network engineers and I are missing?

Update Under the category of information I could've used in advance, apparently they have some IBM application that prevents use of a wildcard cert. What it does or how it goes about it, I have no idea.

Thanks!

share|improve this question
add comment

1 Answer

up vote 9 down vote accepted

That's not correct.

A wildcard certificate has nothing to do with being able to generate certificates; it is a single certificate that will authenticate all subdomains of the CN the certificate refers to.

So if you purchased a wildcard certificate for *.example.com, that means the web server that runs orders.example.com can use that certificate.

CSRs don't enter into it, as those are used to request a hostname-specific certificate, which you don't want to use.

Replace the orders certificate with the wildcard one.

share|improve this answer
    
I had every reason to believe what you've confirmed. Thank you. –  John Spiegel Jan 11 '13 at 16:16
1  
It is possible to have a single cert ( orders.example.com ) and a wildcard ( *.example.com ). This is especially important if you want to use *.example.com, but have a 3rd party host your shop ( orders.example.com ) or your cdn ( cdn.example.com ) or statistics ( stats.example.com ). –  becomingwisest Jan 11 '13 at 19:49
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.