It has been established that there's no technical limitations:
You can buy certificates for the same domain from different sources.
DV and EV certificates can be mixed on different subdomains or even on different instances of the very same hostname, like e.g. Twitter does.
Wildcard and multidomain certificates can co-exists on the same domain in any combination.
In his answer Lie Ryan explains some caveats I would like to extend a little and then provide some solutions that don't directly answer the question, but may be helpful in this situation. This is also what truly makes this a security question rather than a general question about server configuration.
It's not only you who could get a DV certificate under your domain, whether it already has an EV certificate or not, but anyone who has access to the document root on your subdomain can get a DV certificate for it. It's very common that using some third party service requires an additional A
/ AAAA
record to your DNS zone.
Administrative control though CAA
records
In this situation Certification Authority Authorization (CAA
) Resource Records specified in RFC 6844 may become useful. It was mandated in Sep 2017 by CA/Browser Forum, so now it's finally useful. If you would like e.g. only Symantec to issue certificates for your domain, you'd add a DNS record:
example.com. IN CAA 128 issue "symantec.com"
Now, you need also to have Let's Encrypt for your static.example.com
and for that subdomain alone i.e. you don't want thirdparty.example.com
to be able to get one, too. The CAA
is inherited from the parent domain, but a new CAA
record will override it. Finally, issue ";"
states no CA should issue a certificate.
static.example.com. IN CAA 128 issue "letsencrypt.org"
thirdparty.example.com. IN CAA 128 issue ";"
Technical control through HTTP Public Key Pinning (HPKP)
This is technically stronger than the CAA approach, paranoia level up, but is not an alternative to it. There's this Public-Key-Pins
response header that could list hashes for your certificates.
The server having your EV certificate can introduce your static.example.com
DV certificate's public key with its own, making both trusted by the browsers and anything else untrusted. But this can also be a lot more dangerous:
HPKP has the potential to lock out users for a long time if used
incorrectly! The use of backup certificates and/or pinning the CA
certificate is recommend.