Where did this wildcard SSL certificate come from?

Question

My company is hosting example.com and sub.example.com on the same server, using a wildcard SSL certificate for *.example.com. Now it's time to renew our certificate, and we're not sure how we got that certificate. My boss doesn't think we paid the $200 that they appear to cost. My old manager (who left the company a few days ago) was the one to install it, and he doesn't remember exactly what he did, but he thinks he had to generate something instead of just using files we were given by the CA.

The apache config has these lines, and no other uncommented SSL*File lines:

SSLCertificateFile /usr/local/ssl/cert/example.com.crt
SSLCACertificateFile /usr/local/ssl/cert/intermediate.crt
SSLCertificateKeyFile /usr/local/ssl/private/example.com-wild.key

When I examine intermediate.crt (openssl x509 -in intermediate.crt -text -noout), it doesn't mention our organization or website at all, and it's valid 2010-2020.

Data:
    Version: 3 (0x2)
    Serial Number: 145105 (0x236d1)
    Signature Algorithm: sha1WithRSAEncryption
    Issuer: C=US, O=GeoTrust Inc., CN=GeoTrust Global CA
    Validity
        Not Before: Feb 19 22:45:05 2010 GMT
        Not After : Feb 18 22:45:05 2020 GMT
    Subject: C=US, O=GeoTrust, Inc., CN=RapidSSL CAb

example.com.crt is the wildcard:

Data:
    Version: 3 (0x2)
    Serial Number: 1113972 (0x10ff74)
    Signature Algorithm: sha1WithRSAEncryption
    Issuer: C=US, O=GeoTrust, Inc., CN=RapidSSL CA
    Validity
        Not Before: Mar  1 09:05:39 2014 GMT
        Not After : Mar  4 09:08:54 2015 GMT
    Subject: serialNumber=T0nuTvfeaQVtd3dZ30zGI94HrvUsoRjx, OU=GT53409919, OU=See www.rapidssl.com/resources/cps (c)14, OU=Domain Control Validated - RapidSSL(R), CN=*.example.com

I don't understand SSL infrastructure, so I guess I have a bunch of related questions. I apologize if they turn out not to be at all related; I don't know what I don't know.

• How did we get the wildcard certificate, if we didn't pay $200 or whatever for it? (I'd be moderately surprised if we could have created it with just intermediate.crt, because then we could keep generating them until 2020. But there are no other files in /usr/local/ssl, and nothing in /etc/pki/tls that's been modified since 2013, so what else would we have used? I'd also be moderately surprised if my boss is just misremembering and we did pay $200 or something, but that does seem possible to me.)

• Where did we get intermediate.crt?

• What does intermediate.crt do? I have a self-signed wildcard certificate that works fine (except that it's self-signed) on our beta servers, with no SSLCACertificateFile line; and we've bought a non-wildcard certificate that protects example.com which I've managed to install using VirtualHost with no SSLCACertificateFile, and we're in the process of getting a certificate for sub.example.com which I'm planning to install the same way. Is the SSLCACertificateFile needed for non-self-signed wildcard certificates?

  The way I generated the self-signed cert feels like it might be related:

  openssl req -nodes -new -keyout private/example.com.key -out certs/intermediate.csr
  openssl x509 -req -days 365 -in certs/intermediate.csr -signkey private/file.key -out certs/example.com.crt
  

  but I don't need to mention intermediate.csr in the apache config in this case, and intermediate.csr can't be examined by openssl x509 like the intermediate.crt file can.

Answer 1

How did we get the wildcard certificate, if we didn't pay $200 or whatever for it?

A cheaper CA than you found now? I'm sure you'll find a reseller with lower prices.

Where did we get intermediate.crt? What does intermediate.crt do?

You have it form your CA. CA's ususally don't sign certs directly with their Root certificates, but do this via an intermediate cert. This intermediate cert signs the certs for customer and is in turn signed by the root cert, which is trusted by browsers and OS'. This is called the certificate chain and also the reason why there is a separate parameter for Apache SSLCACertificateFile to provide this chain from website cert to CA cert.

I have a self-signed wildcard certificate that works fine (except that it's self-signed) on our beta servers, with no SSLCACertificateFile line;

Then the browser you tested also trusts the intermediate cert, but you can't rely on that. You can also use the SSLLabs ssltest tool to check if your chain may be incomplete or missed an intermediate (called extra download there).

Is the SSLCACertificateFile needed for non-self-signed wildcard certificates?

No, because there is no certificate chain in this case, see above.

Answer 2

It seems pretty clear based on the details in your cert and the intermediate that your old manager did indeed pay whatever it cost for a wildcard cert from RapidSSL a year ago. What he had to generate was likely the certificate request to submit to RapidSSL.