Home / server / Questions / 705204
Accepted
chrism2671
Asked: 2015-07-13 10:44:05 +0800 CST

Creating sub certificates from a root certificate (SSL) [duplicate]

  • 772

If I purchase a signed certificate for example.com, can I then produce sub-certificates for a.example.com and b.example.com?

These sub-certificates would have PEM files whose privacy cannot be assured.

Can I do this, maintaining the privacy of the root certificate while generating an unlimited number of disposable sub-certificates that would still be recognized as valid by the original signing authority?

ssl

2 Answers

  1. Best Answer

    No, that won't work.

    In order to sign certificates you need your own certificate authority certificate. The certificates you purchase are signed by a certificate authority, but specifically marked as not being a certificate authority certificate.

    Check the "Certificate Basic Constraints" in your certificate, and you will see that it "Is not a Certification Authority".

    • 17

  2. If you need more then one domain covered by SSL, you need to buy a wildcard SSL certificate. This covers a domain name and all sub-domains. Remember to create your SSL cert for *.example.com: otherwise you only sign your normal domain.

    If you have two different domains you need SSL for each domain.

    Or if you have only one subdomain, sometimes two normal SSL certs are cheaper than a wildcard.

    • 4