networking - Can an SSL cert (not self-signed) be used to create another SSL cert for another host in the same domain?

06
2014-04
  • AlJo

    I have a regular SSL certificate issued by Network Solutions for a given host, say "host A". Can I create another SSL cert for the wiki host that has the host A cert in its trust path and therefore works for use on the wiki host? Both hosts are in the same domain, for example:

    a.host.com <- host A uses purchased SSL cert; CA is Network Solutions

    wiki.host.com <- needs its own cert

    This question is based on my assumption that since I own a trusted cert from a trusted CA for my domain, then I should be able to use that cert to make others for other hosts on the same domain and those new certs should be trusted since they record the "trust path" up to a trusted CA.

    • Answers
  • Bandrami

    Yes and no.

    From a technical standpoint, you can use the certificate with the common name a.host.com to sign the certificate for wiki.host.com, so in that sense, "yes".

    However, nobody has your a.host.com certificate in their trusted CA list, so you're not actually accomplishing anything that you wouldn't with a purely self-signed certificate. So in that sense, "no", or at least, "not usefully".

    If your question is "will browsers trust your a.host.com certificate's signatures of other certificates?" the answer is no, they will not. (The fact that they are in the same domain doesn't change anything here, either.)


    • Related Question

    osx - Accepting self-signed SSL certificates
  • Charles Stewart

    I'd like to tell Macos 10.4 Mail that it can trust a self-signed SSL certificate for an IMAP+SMTP/SSL connection to a mail server I run, so that Mail does not complain each time I fetch mail.

    Can this be done?


    • Related Answers
  • Joshua Levitsky

    So this is how I add a Verisign intermediate cert to my desktops. I think the same would work for your self-signed cert. I put the file in /Library/Management/Certs/ on my target machines and then run the below script on them. That adds the cert to the system keychain.

    #!/bin/sh

/usr/bin/security add-certificates -k /Library/Keychains/System.keychain /Library/Management/Certs/VeriSign\ Class\ 3\ Secure\ Server\ CA.cer

exit
  • MagerValp

    To trust the root certificate, use:

    sudo /usr/bin/security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain cacert.cer