Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What type of digital certificate product do I need to begin a digital security infrastructure within my company and for use by our customers (pre-trusted by chaining)?

I believe I need some kind of root organizational cert that is signed by a public CA and provides me the ability to create a sign other certs within my organization for SSL and for code signing and for client certs and whatever else I might need. I expect chaining to work to validate for customers to the issued organizational cert and up to the public CA.

When I go to the major CAs I know about, I don't see any products availble that obviously fit my expectation.

I've generated self-signed certs a few times, and I've bought exact-domain SSL certs. But now I need a bigger plan.

I'm also aware of opinions/facts that the CA system is flawed so you don't have to spend much time on that in your answer.

share|improve this question

closed as too broad by mdpc, MichelZ, RolandoMySQLDBA, Jacob, Nathan C Apr 29 '14 at 14:56

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

You won't find a public CA that will grant you a signing certificate. You start your own CA, then distribute that CA cert to the trust store of your clients. This is typically done in Windows via group policy or in other OSes via your CM system. – EEAA Apr 27 '14 at 13:40
Tangentially related:… – dawud Apr 27 '14 at 13:46
What exactly is the "bigger plan"? What are you trying to do with those certs? – MichelZ Apr 28 '14 at 6:42
@MichaelZ - I always thought that big companies have their own master certs that they use to issue other certs (still directly related to the company's brands) for new SSL sites, digital signatures, code signing, etc. I didn't think they were resolved to buying a separate cert for each activity (besides wildcard SSL). – Jason Kleban Apr 28 '14 at 11:12
up vote 8 down vote accepted

Your assumptions are wrong - no public CA will issue you a certificate to use as your root certificate.

You generate your own, self signed certificate authority and distribute it to clients to make them trust you.

Then you use that to sign your certificates.

All public CAs are self signed - they are included in your OS or browser because the OS vendor decided they are trustworthy and added them. If they did issue you a signing certificate, you could use it to make a perfectly valid certificate for or That would be bad. Unless you are the NSA or something, they are not going to do that.

On windows, distributing the certificate is done virtually automatically through active directory to all domain connected computers.

If you want certificates that are trusted outside your network, you need to buy individual or wildcard certificates for each domain. Running your own CA is usually only used inside your own network. It can work externally, but you need to ensure people add your root certificate to their trusted certificates.

share|improve this answer

If your organization has only one domain you can get a wildcard cert for that domain.

This will allow you to use one cert for all subdomains.

If you have multiple domains, you'll need one for each. If you want to have multiple domains one one server sharing the default ssl port, you'll need to use server name indication (SNI) to serve up the correct cert.

share|improve this answer
This does not answer the question asked. – EEAA Apr 27 '14 at 14:15

Not the answer you're looking for? Browse other questions tagged or ask your own question.