Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Can you get an Extended Validation SSL certificate that applies to unlimited subdomains? Does it make technical sense? I'm using Digicert and they said that it wasn't possible to offer such a product.

share|improve this question

3 Answers 3

up vote 4 down vote accepted

Zoredache is correct. The EV Guidelines do not allow CAs to issue wildcard EV certificates. It does allow them to add multiple SAN names that can cover different subdomains or different domains and some providers are offering products that take advantage of this, but they are not wildcard certificates, just UC or SAN certificates.

So it is possible to cover "multiple" subdomains with an EV certificate but not "unlimited" subdomains.

share|improve this answer
    
Somewhere I saw a statement that only TLD domains are possible on SAN, but wikipedia en.wikipedia.org/wiki/Extended_Validation_Certificate shows example on SSL.COM, where domains like support.ssl.com. So can I have some third level domain name in SAN or not ? –  Radek Nov 11 at 18:49

The guidelines seem to explicitly forbid usages of wildcards in EV certs.

http://cabforum.org/EV%5FCertificate%5FGuidelines%5FV11.pdf

Certificate Field subject:commonName (OID 2.5.4.3) or SubjectAlternativeName:dNSName Required/Optional Required Contents This field MUST contain one or more host domain name(s) owned or controlled by the Subject and to be associated with Subject’s server. Such server MAY be owned and operated by the Subject or another entity (e.g., a hosting service). Wildcard certificates are not allowed for EV certificates.

share|improve this answer

While I'm not one to disagree with someone like Zoredache, I will point out that multiple CA's offer wildcard EV certificates for both sub-domains and in some cases multiple domains themselves.

See below:

http://www.globalsign.com/ssl/buy-ssl-certificates/unified-communications-ssl/

http://www.instantssl.com/ssl-certificate-products/addsupport/ssl-ev-mdc.html

share|improve this answer
1  
Huh? Where on either page do you see an offer of a wildcard EV certificate?! –  David Schwartz Aug 28 '11 at 6:44
    
The Global Sign link is for a "Unified Communications" cert. They use wiggly language to make it seem like it's the same thing. EV certs are on this page : globalsign.com/ssl/buy-ssl-certificates/extended-validation-ssl/… and do not offer unlimited sub domains. –  EricB Jun 1 '12 at 19:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.