1

I have a few self hosted servers on my domain and my main website is hosted on Godaddy itself. One self hosted server needs an EV Certificate and we didn't want to change that, but I figured the others could all use one wildcard certificate.

This is the GoDaddy wildcard cert page https://www.godaddy.com/web-security/ssl-certificate/wildcard-ssl-certificate

After you purchase the cert you find out in the control panel that you can either use that wilcard cert on your hosted site OR on your own self hosted server even though it clearly states on the page in the link above, the cert can be used to secure multiple subdomains on multiple servers.

So I started a support chat and just ended up feeling stupid.

Me I'm more interested in where it says, before you buy a wilcard cert, that it can't be used on a goddady hosted site and self served subdomain.

Him Ah. That would just be generic knowledge. There would be no way for us to list all the possible scenarios for things that work and don't work with SSLs Me I assume you mean because you don't have the key I should know that it can't be used on my servers and yours. Him It would be because of how the servers are secured on the backend of the shared hosting.

In the end he offered to change the wildcard cert out for multiple named certs.

Here's the question. Why couldn't this be done? Couldn't they just install the cert on the hosted servers and then provide the certficate and key file for me to use on my own servers? I know that's not an ideal situation but realistically it's all my domain and I'm already trusting them to host my secure site.

W.Jackson
  • 113
  • 5

1 Answers1

1

From a SSL perspective this is possible -- nothing says you can't have the same cert in multiple locations. They might be doing something like reusing their private key for multiple certs on their shared hosting and thus could not provide it to you, or perhaps have automation around renewals that would tend to break your self-hosted component unexpectedly.

They may also be using a mega-cert for their shared hosting, such that your wildcard name is added into a long list of SubjectAltNames -- so they obviously cannot provide that cert to you.

Jason Martin
  • 4,865
  • 15
  • 24