Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Is it possible to buy an intermediate certificate to use it to sign subdomain certificates? It has to be recognised by browsers and I can't use a wildcard certificate.

The search turned up nothing so far. Is anyone issuing such certificates?

share|improve this question
2  
DigiCert Enterprise lets you pre-validate your domain and then do large-scale subdomain certificate generation. (Disclosure: I do not work for DigiCert, but my employer uses their certificate services.) –  Moshe Katz Jun 19 '14 at 23:12

3 Answers 3

up vote 11 down vote accepted

The problem is, that the currently used infrastructure and implementation does not support intermediate certificates which are limited to only some (sub)domains. This, in effect, means that you can use any intermediate certificate to sign any certificate you want and the browsers will trust it, even if this would be certificates for domains you don't own.

Thus, such intermediate certificates are only given to really trustworthy organizations, whatever this means (but lots of money is probably involved).

share|improve this answer
5  
Yes, really trustworthy organizations such as Comodo or DigiNotar. Or VeriSign ("I'm looking for a Microsoft cert..."/"Here you go"). TURKTRUST, Digicert Sdn. Bhd, ... –  basic6 Jun 17 '14 at 10:26
    
Actually no - they run their own root and intermediate. Replacing the root is complex - so what is normally done is using a root certificate ONLY to sign an intermediate CA certificate then take the root ca offline. ;) –  TomTom Jun 24 '14 at 6:10

No, because it would be a violation of the original certificate - browsers wuld trust your certificates and you could start issuing stuff for google.com etc. - and if you do that smart you would not be easy to get.

Intermediate Certificate Authorities have a lot of power. An intermediate CA is a certificate signing authority - that is trusted via the root certificate - and nothing in the specification allows limiting the subordinate CA

As such no reputable certificate organization is going to give it to you.

share|improve this answer
3  
Sure but I was under the impression that you could limit intermediate certificate scope (e.g. to a single domain). Another answer seems to imply that's not the case. –  Alex B Jun 17 '14 at 7:23
1  
It is not the case. An intermediate CA is a certificate signing authority - that is trusted via the root certificate - and nothing in the specification allows limiting the subordinate CA. –  TomTom Jun 17 '14 at 7:45
    
@TomTom: Good explanation. I took the liberty of editing your comment into your answer. –  sleske May 19 at 12:15

It is/was possible to buy a valid CA from GeoTrust.

I was not able to find the product on the English pages, but here is an archived version:

http://archive.is/q01DZ

To purchase GeoRoot you must meet the following minimum requirements:

  • Net worth of $5M or more
  • A minimum of $5M in Errors and Omissions insurance
  • Articles of Incorporation (or similar) and an incumbency certificate provided
  • A written and maintained Certificate Practice Statement (CPS)
  • A FIPS 140-2 Level 2 compliant device (GeoTrust has partnered with SafeNet, Inc.) for key generating and storing your root certificate keys
  • An approved CA product from Baltimore/Betrusted, Entrust, Microsoft, Netscape or RSA

The product is still available on their German page:

http://www.geotrust.com/de/enterprise-ssl-certificates/georoot/

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.