Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Is it possible to buy an intermediate certificate to use it to sign subdomain certificates? It has to be recognised by browsers and I can't use a wildcard certificate.

The search turned up nothing so far. Is anyone issuing such certificates?

share|improve this question
DigiCert Enterprise lets you pre-validate your domain and then do large-scale subdomain certificate generation. (Disclosure: I do not work for DigiCert, but my employer uses their certificate services.) –  Moshe Katz Jun 19 '14 at 23:12

2 Answers 2

up vote 10 down vote accepted

The problem is, that the currently used infrastructure and implementation does not support intermediate certificates which are limited to only some (sub)domains. This, in effect, means that you can use any intermediate certificate to sign any certificate you want and the browsers will trust it, even if this would be certificates for domains you don't own.

Thus, such intermediate certificates are only given to really trustworthy organizations, whatever this means (but lots of money is probably involved).

share|improve this answer
Yes, really trustworthy organizations such as Comodo or DigiNotar. Or VeriSign ("I'm looking for a Microsoft cert..."/"Here you go"). TURKTRUST, Digicert Sdn. Bhd, ... –  basic6 Jun 17 '14 at 10:26
Actually no - they run their own root and intermediate. Replacing the root is complex - so what is normally done is using a root certificate ONLY to sign an intermediate CA certificate then take the root ca offline. ;) –  TomTom Jun 24 '14 at 6:10

No, because it would be a violation of the original certificate - browsers wuld trust your certificates and you could start issuing stuff for google.com etc. - and if you do that smart you would not be easy to get.

Intermediate Certificate Authorities have a lot of power and as such no reputable certificate organization is going to give it to you.

share|improve this answer
Sure but I was under the impression that you could limit intermediate certificate scope (e.g. to a single domain). Another answer seems to imply that's not the case. –  Alex B Jun 17 '14 at 7:23
It is not the case. An intermediate CA is a certificate signing authority - that is trusted via the root certificate - and nothing in the specification allows limiting the subordinate CA. –  TomTom Jun 17 '14 at 7:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.