Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a wildcard certificate for * (signed by GeoTrust) and am going to host lots of application instances on different servers, each on my subdomain.

I am not willing to copy my OpenSSL private key to every customer. How do I use my certificate to create sub-certificates for individual subdomains without sharing mine?

share|improve this question
Setup a proxy server? Put your SSL certificate on the proxy server. Use internal certs for internal communication between the proxy server and internal servers. – Zoredache Apr 15 '14 at 17:06
up vote 5 down vote accepted

With some providers of SSL certificates (Digicert as one) you can generate new private keys and CSRs to request certificates on each server. This allows you to maintain separate private keys (and also generate these certificates for subdomains using Subject Alternative Names.). This does increase the administrative burden, but decreases the risk of sharing a single private key.

share|improve this answer
Can you explain that please? Makes no sense... – MichelZ Apr 15 '14 at 14:55
You can generate duplicate certificates, built from different private keys. Maybe I'm just spoiled by digicert :… But with DigiCert's unlimited server license, you can use your certificate on as many servers as you want. You can even generate separate certificates with unique key pairs for each server – NickW Apr 15 '14 at 14:58
Is it Digicert who does that, or I can issue sub-certificates myself? – kolypto Apr 15 '14 at 15:34
Digicert. You cannot issue certificates unless they are self signed ones. (or with super-special agreements where you get a sub-ca) – MichelZ Apr 15 '14 at 15:36
Yeah, I could phrase that better: (2nd half of that page). – NickW Apr 15 '14 at 15:49

This is not possible. You either need self-signed certificates or you need individual certificates.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.