SSL Certificate types e.g. Commerce, Web Server, and Wildcard

Question

I have to request a ssl certificate and was told that the host requires a SSL Web Server Cert. I only know of two kinds, SSL domain specific and Wildcard SSL. A long time ago I heard that depending on who gave you the cert it could or could not be used for E-commerce sites. However this is the first time I have Heard of a SSL Web Server certificate. I'm concerned it just a type of product being sold by a vendor

What kind are the real non product names and types of SSL certificates?

Answer 1

Long story short... You're mixing up your apples with your oranges. The subject of a certificate has nothing to do with the key usages of certificate.

Wildcard certificates are certificates where the domain-name has a wild-card (an asterisk) instead of a specific domain name. For example: A certificate that has "*.example.com" as it's subject, would be valid for www.example.com, fish.example.com and even lvl1.lvl2.lvl3.lvl4.example.com. These are much cheaper than buying multiple domain-specific certificates when you have additional sub-domains that you use on the same top-level domain. Unfortunately, if your private key becomes compromised... a hacker could setup anything under your domain and it would appear as valid.

Now, for the key-usage portion of the certificates. Certificates can have very specific usages defined. Different "Certificate Authorities" have some pre-defined certificate templates that assign a set of 'key usages'. For example, a "Secure Web certificate" typically defines that the certificate has the Server Authentication usage and the Client Authentication usage. This means that the web-server should be trusted to handle server/client authentication for the domain defined in the subject of the certificate. (could be a wild-card domain or a specific domain) Other secure services can also use that same certificate as long as it provides the key usages that are required by that service. For example, if you were to setup an XMPP server, you can use that same certificate to securely authenticate your clients for that domain, as XMPP does not need additional key usages to establish a connection.

There are many other potential uses for certificates, such as:

• Code Signing
• Secure Email
• Time Stamping
• OCSP Signing
• Encrypting File System
• IP security tunnel termination
• IP security user
• IP security IKE intermediate

Different certificate authorities have different requirements and costs associated with the various certificate usages.