Home / server / Questions / 765674
In Process
bkr
Asked: 2016-03-24 09:17:54 +0800 CST

Can I purchase 2 wildcard certificates with the same subject from 2 different CA vendors?

  • 772

Say I have an existing wildcard cert (*.example.com) from Vendor A (eg Symantec) licensed for 2 servers.

And now I want to purchase the same subject (*.example.com) from Vendor B (eg. RapidSSL) for install on multiple other locations.

On the face of it this should work, but is there any reason I can't do this - for licensing or technical reasons?

The motivation is twofold - the environment that the existing wildcard certs is installed into is sensitive and change cannot be made to it rapidly. And secondly, the pricing of Vendor A who charges "per server" licensing is too high for the deployment we're considering which will involve many servers.

ssl-certificate

3 Answers

  1. On the face of it this should work, but is there any reason I can't do this - for licensing or technical reasons?

    No, there is no license or technical reason you should not do this. It seems clumsy and ineffecient in the long-term, but I suspect this is a short-term thing, so go for it.

    • 3

  2. Clients do not care which CA generated a cert as long as it is in their trust store. A caveat is if you've done anything to pin the expected cert on the clients such as described at https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning.

    • 1

  3. It is simply not possible to do so. Just because your server will not allow to install multiple SSL certificates on Single domain name. SSL certificate can be only issued on FQDN (frequently qualified domain name).

    Let us understand how HTTPS actually works.

    • Step 1: Client connects to the server

    • Step 2: SSL/TLS negotiation (includes exchanging certificates, certificate verification, and encryption setup)

    • Step 3: Client sends request (includes server hostname, path, cookies, etc)

    • Step 4: Server sends back response (includes response headers, content, etc)

    Citation: https://security.stackexchange.com/questions/46988/is-it-technically-possible-to-configure-two-different-ssl-certificates-for-the-s

    So one by one, steps will help server to verify the information. In addition, PKI (Public Key Infrastructure) makes it even harder to authenticate identity of the domain ownership. Exchange of sensitive information on the INTERNET is totally depended on Public Key Infrastructure. A typical PKI consists of hardware, software, policies, and standards to manage the creation, administration, distribution, and revocation of keys and digital certificates. Digital certificates are at the heart of PKI as they affirm the identity of the certificate subject and bind that identity to the public key contained in the certificate. Read more.

    Moreover, your concern on charge for multiple server licenses can be easily solved. Many certificate authorities (i.e. Thawte, Comodo) offer unlimited server licenses on their digital certificates. So if your certificate is about to expire in near future, I would suggest to switch on other SSL certificate that offers unlimited server licensing.

    • -1