-1

I have a regular SSL certificate issued by Network Solutions for a given host, say "host A". Can I create another SSL cert for the wiki host that has the host A cert in its trust path and therefore works for use on the wiki host? Both hosts are in the same domain, for example:

a.host.com <- host A uses purchased SSL cert; CA is Network Solutions

wiki.host.com <- needs its own cert

This question is based on my assumption that since I own a trusted cert from a trusted CA for my domain, then I should be able to use that cert to make others for other hosts on the same domain and those new certs should be trusted since they record the "trust path" up to a trusted CA.

1
  • To me, the best would be to update your certificate request to add wiki.host.com as an alternate name of a.host.com. This way you can use the same cert on both host
    – krisFR
    Jan 1, 2014 at 15:03

2 Answers 2

3

No.

The reason is that there are different types of certificates for different purposes.

The cert you have has the purpose of Server Authentication, which is reflected in the Enhanced Key Usage property: Server Authentication (1.3.6.1.5.5.7.3.1)

Other certs have the purpose of: Client Authentication (1.3.6.1.5.5.7.3.2)

To create (sign) other certificates, you need a certificate with the Key usage of Certificate Signing

If you would have such a certificate you would be a root certification authority or at least an intermediate certification authority.

If anybody with any certificate could sign other certificates, the trust chain would be severely broken.

3

No.

You'd need to have the CA issue a cert for the additional hosts. Alternatively, you can request a *.example.com wildcard domain cert which would allow you to use it on any number of sub domains.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .