1

I own example.com, and I'd like to get an SSL cert. Normally I would simply buy a wildcard cert, so that I can add subdomains for future purposes.

However, I need to let a trusted 3rd party operate a subdomain of my site: 3rdparty.example.com. Our site will link to theirs for some specific functionality. We will keep the site look and feel the same so that users don't get confused. For the same reason we'd like to keep the 3rd party site under our domain.

What kinds of SSL certs do I need to buy for this scenario? They want me to buy the cert for the 3rdparty subdomain and send it to them.

edit:

The 3rd party is not competent, and I've never had to dive very deep into SSL. Based on the feedback and additional reading, I will outline the CSR fields (so they don't misspell anything) and ask them to create the CSR and send it to me. I will then apply for the 3rdparty.example.com cert, which according to godaddy also applies to www.3rdparty.example.com. There is no need for me to ever touch the private key used to sign the CSR, I can revoke the certificate using godaddy's web console if needed.

Can I still get a wildcard ssl cert for myself for *.example.com, or will this cause a conflict somehow? I haven't seen this exact scenario addressed anywhere.

Improve this question

1 Answer 1

Reset to default
3

Just get a standard certificate for whatever the domain name is that will be used to access resources on that side. There really should need to be anything special.

I am a bit curious about the bit of having you purchase the certificate. Did they send you a certificate signing request? If not, then you should have them generate the private key and CSR for the correct name, so you can purchase the certificate. The private key should be private which means they should be generating it, not you creating one and transferring it to them.

Improve this answer
2
  • I agree with your argument about the private key, but if it's his domain anyway and he's effectively responsible for it (and confirming to the CA that a cert should be issued with this name), it would make sense for him to have the private key too. (It might simplify the revocation procedure in case of conflict, perhaps.)
    – Bruno
    Apr 24, 2012 at 22:04
  • @Bruno, if he generates it, then there is multiple copies, weakening security. He will also have to arrange for some kind of secure transport. Does the 3rd party have some kind of https web portable to upload the pkcs12 file? Surely you wouldn't suggest that he email it? I suppose in some cases the value of having a copy is worth the added risk of having multiple copies of the key, and transporting it over the Internet. Anyway, the 3rd party should be able to tell him what they prefer, if they aren't incompetent.
    – Zoredache
    Apr 25, 2012 at 0:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .