I have a wildcard certificate (pfx file) and I have doubts on how to use that. Should I install that on all of my application servers or alternatively create a new certificate and sign it with the wildcard cert?
I've read there are restrictions regarding these issues and that not all of the wildcard certificates can sign others, so how do I check if I can do it?
But most importantly, should I do it? I ask this because from what I've read, the pfx file contains the private key of the wildcard. By other words the private key of the domain so if a server is compromised and this file gets stolen the consequences can be quite dramatic.
Am I understanding this situation correctly?