0

I have a wildcard certificate (pfx file) and I have doubts on how to use that. Should I install that on all of my application servers or alternatively create a new certificate and sign it with the wildcard cert?

I've read there are restrictions regarding these issues and that not all of the wildcard certificates can sign others, so how do I check if I can do it?

But most importantly, should I do it? I ask this because from what I've read, the pfx file contains the private key of the wildcard. By other words the private key of the domain so if a server is compromised and this file gets stolen the consequences can be quite dramatic.

Am I understanding this situation correctly?

1 Answer 1

2

Should I install that on all of my application servers

Yes.

or alternatively create a new certificate and sign it with the wildcard cert

That will not be possible.

... that not all of the wildcard certificates can sign others

No CA will give you a certificate to sign others (at least not unless you have lots of money and a solide knowledge of certificates and how to keep them secure etc, which you currently don't have).

so if a server is compromised and this file gets stolen the consequences can be quite dramatic

Yes, if a server is compromised the private key can be compromised so you really have to keep the server secure.

3
  • Thanks! But this begs the question, how do I keep my private key secure? Just with security policies on the operating system?
    – Silva
    Dec 5, 2014 at 18:21
  • Ok, I got your edit... That makes things clearer for me. Thank you!
    – Silva
    Dec 5, 2014 at 18:22
  • The most safest way to kep private key secure is to use Hardware Security Module (HSM).
    – Crypt32
    Dec 7, 2014 at 9:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .