Wildcard Certificate Risks

But that was when certificates were managed manually.

Wildcard certificate risks. If the the private key for above wildcard certificate were ever compromised it would compromise the secure connections to all the servers which fall under the domains listed in the certificate. If one server or sub domain is compromised all sub domains may be compromised. The only other gotcha that im aware of is that extended validation certificates cannot be issued with a wildcard so its not an option if youre going for an ev certificate. If the private key is stolen or the certificate expires.

Using a wildcard certificate on a publicly facing webserver you can quickly secure unlimited subdomains that are all encrypted by the same certificate. A final risk that applies to both wildcard and multi domain certificates is that you multiply the scope of any potential issues with the certificate. These changes can be risky and result in downtime for your websites. Think about it a single key for possibly hundreds of servers.

Wildcard certificate management issues and as you can imagine when wildcard certificates are compromised management headaches follow. Unfortunately so can cybercriminals. A wildcard certificate is a public key certificate used by all subdomains within a larger domain. Its easy to share a single wildcard certificate across multiple machines and services and renew only one certificate to have all your services secured for another 2 years.

A wildcard certificate protects all subdomains of a domain subject to the use of wildcard characters in the name. The verisign site lists their take on the disadvantages of wildcard certs. A conventional certificate works on a single domain eg. Indeed the ssl server has no interest in looking at its own certificate.

In terms of the security youve hit the nail on the head a single private key protects all domains that are under the wildcard. Not long ago wildcard certificates were sought because of the very thing that makes them risky. That certificate is for the benefits of clients to convince them that the public key contained in the certificate is indeed the public key of the genuine ssl server. However from a security standpoint these certificates open up a can of worms.

If the wildcard certificate needs to be revoked all sub domains will need. Wildcard certificates dont imply extra vulnerabilities for the ssl server. When a non wildcard certificate is compromised the certificate must be revoked and then re issued to every server that uses it. Another product gaining popularity due to competition is the wildcard certificate.

Using wildcard certificates reduces the overall burden on system administrators.