What type of digital certificate product do I need to begin a digital security infrastructure within my company and for use by our customers (pre-trusted by chaining)?

I believe I need some kind of root organizational cert that is signed by a public CA and provides me the ability to create a sign other certs within my organization for SSL and for code signing and for client certs and whatever else I might need. I expect chaining to work to validate for customers to the issued organizational cert and up to the public CA.

When I go to the major CAs I know about, I don't see any products availble that obviously fit my expectation.

I've generated self-signed certs a few times, and I've bought exact-domain SSL certs. But now I need a bigger plan.

I'm also aware of opinions/facts that the CA system is flawed so you don't have to spend much time on that in your answer.

  • 5
    You won't find a public CA that will grant you a signing certificate. You start your own CA, then distribute that CA cert to the trust store of your clients. This is typically done in Windows via group policy or in other OSes via your CM system.
    – EEAA
    Apr 27, 2014 at 13:40
  • 1
    Tangentially related: serverfault.com/questions/274852/…
    – dawud
    Apr 27, 2014 at 13:46
  • What exactly is the "bigger plan"? What are you trying to do with those certs?
    – MichelZ
    Apr 28, 2014 at 6:42
  • @MichaelZ - I always thought that big companies have their own master certs that they use to issue other certs (still directly related to the company's brands) for new SSL sites, digital signatures, code signing, etc. I didn't think they were resolved to buying a separate cert for each activity (besides wildcard SSL). Apr 28, 2014 at 11:12

2 Answers 2


Your assumptions are wrong - no public CA will issue you a certificate to use as your root certificate.

You generate your own, self signed certificate authority and distribute it to clients to make them trust you.

Then you use that to sign your certificates.

All public CAs are self signed - they are included in your OS or browser because the OS vendor decided they are trustworthy and added them. If they did issue you a signing certificate, you could use it to make a perfectly valid certificate for google.com or microsoft.com. That would be bad. Unless you are the NSA or something, they are not going to do that.

On windows, distributing the certificate is done virtually automatically through active directory to all domain connected computers.

If you want certificates that are trusted outside your network, you need to buy individual or wildcard certificates for each domain. Running your own CA is usually only used inside your own network. It can work externally, but you need to ensure people add your root certificate to their trusted certificates.


If your organization has only one domain you can get a wildcard cert for that domain.


This will allow you to use one cert for all subdomains.

If you have multiple domains, you'll need one for each. If you want to have multiple domains one one server sharing the default ssl port, you'll need to use server name indication (SNI) to serve up the correct cert.


  • This does not answer the question asked.
    – EEAA
    Apr 27, 2014 at 14:15

Not the answer you're looking for? Browse other questions tagged .