Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to buy an intermediate certificate to use it to sign subdomain certificates? It has to be recognised by browsers and I can't use a wildcard certificate.

The search turned up nothing so far. Is anyone issuing such certificates?

share|improve this question
DigiCert Enterprise lets you pre-validate your domain and then do large-scale subdomain certificate generation. (Disclosure: I do not work for DigiCert, but my employer uses their certificate services.) – Moshe Katz Jun 19 '14 at 23:12
up vote 13 down vote accepted

The problem is, that the currently used infrastructure and implementation does not support intermediate certificates which are limited to only some (sub)domains. This, in effect, means that you can use any intermediate certificate to sign any certificate you want and the browsers will trust it, even if this would be certificates for domains you don't own.

Thus, such intermediate certificates are only given to really trustworthy organizations, whatever this means (but lots of money is probably involved).

share|improve this answer
Yes, really trustworthy organizations such as Comodo or DigiNotar. Or VeriSign ("I'm looking for a Microsoft cert..."/"Here you go"). TURKTRUST, Digicert Sdn. Bhd, ... – basic6 Jun 17 '14 at 10:26
Actually no - they run their own root and intermediate. Replacing the root is complex - so what is normally done is using a root certificate ONLY to sign an intermediate CA certificate then take the root ca offline. ;) – TomTom Jun 24 '14 at 6:10
Picking on google for no particular reason, but since they have an intermediate CA and don't sell certs, there's a reasonable chance it could be stolen and abused without rapid detection for MITM between a pair of hosts doing SMTP over TLS. I suspect that quite a few sysadmins wouldn't think too much if a cert changed for an SMTP connection to one issued by google. – Phil Lello Mar 18 at 16:18
... Indeed, this may be what happens when a business switches to google apps for email. – Phil Lello Mar 18 at 16:24

No, because it would be a violation of the original certificate - browsers wuld trust your certificates and you could start issuing stuff for etc. - and if you do that smart you would not be easy to get.

Intermediate Certificate Authorities have a lot of power. An intermediate CA is a certificate signing authority - that is trusted via the root certificate - and nothing in the specification allows limiting the subordinate CA

As such no reputable certificate organization is going to give it to you.

share|improve this answer
Sure but I was under the impression that you could limit intermediate certificate scope (e.g. to a single domain). Another answer seems to imply that's not the case. – Alex B Jun 17 '14 at 7:23
It is not the case. An intermediate CA is a certificate signing authority - that is trusted via the root certificate - and nothing in the specification allows limiting the subordinate CA. – TomTom Jun 17 '14 at 7:45
@TomTom: Good explanation. I took the liberty of editing your comment into your answer. – sleske May 19 '15 at 12:15
@alexb I believe it's a case of the spec allows it but you can't rely on client implementations to support it. Unfortunately I can't find a reference but am fairly confident. – Phil Lello Mar 18 at 16:21

It is/was possible to buy a valid CA from GeoTrust.

I was not able to find the product on the English pages, but here is an archived version:

To purchase GeoRoot you must meet the following minimum requirements:

  • Net worth of $5M or more
  • A minimum of $5M in Errors and Omissions insurance
  • Articles of Incorporation (or similar) and an incumbency certificate provided
  • A written and maintained Certificate Practice Statement (CPS)
  • A FIPS 140-2 Level 2 compliant device (GeoTrust has partnered with SafeNet, Inc.) for key generating and storing your root certificate keys
  • An approved CA product from Baltimore/Betrusted, Entrust, Microsoft, Netscape or RSA

The product is still available on their German page:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.