我自己为我拥有SSL证书的域的子域发布SSL证书

Question

I guess it can't be done, but if so, I'd like to know why.

Let's say I get an SSL certificate for example.com from one of the official certificate authorities around. Let's also say I'm running a.example.com and bcdexample.com and would like to have SSL certificates for those as well.

Can I use the example.com certificate to issue certificates for a.example.com and bcdexample.com myself? And will they be recognized by users' browsers? If not, why not?

(My guess that it can't be done is because it would break the very lucrative wildcard cert business model, wouldn't it?)

Clarification: can't I act as a "self-signed" certificate authority using the keypair for which I obtained the official cert, and simply add my official cert in the validation chain?

Answer 1

You cannot use Your certificate to issue other certificates, because the purposes of the certificate are encoded in Your certificate and "Certificate Authority" is certainly not included in that list.

Web browsers check the "certificate chain" beginning from Your certificate, the certificate that was used to sign it, the signer of that certificate etc.

Your certificate must match the current use case (mostly "identify web site") and all signing certificates must include the "Certificate Authority" flag. The last certificate must be known to the browser (root cert).

As You already guess, wildcard certificates might help in Your case.

Answer 2

You're correct, you cannot issue certificates from a certificate . You need a Certificate Authority to issue certificates.

The whole point of a Certificate Authority is that they are a trusted 3rd party. CA's like Verisign are trusted by default by most browsers so that you dont have to manually accept certificates from them. They have what is termed a trusted root certificate .

If you create your own Certificate Authority and start dishing out certificates, web browsers will not know you and hance not trust you. The user will be prompted.