I have a security advisor that is telling me that we can't use wildcard SSL certs for security reasons. To be clear I much prefer using single certs or multi-domain certs (SAN). However we have a need for the server (plesk) to server 100s of subdomains.
Based on my research the main reason people site for not using wildcard is the following which appears to come from verisign:
- Security: If one server or sub-domain is compromised, all sub-domains may be compromised.
- Management: If the wildcard certificate needs to be revoked, all sub-domains will need a new certificate.
- Compatibility: Wildcard certificates may not work seamlessly with
older server-client configurations.
- Protection: VeriSign Wildcard SSL Certificates are not protected by NetSure extended warranty.
Since the private key, cert, and subdomain will all exist on the same server... replacement would be as simple as replacing this one cert and effect the same amount of users. Therefore is there another reason not to use a wildcard cert?