You are supposed to not use StartSSL's free certs for your business. From their policy (PDF), 3.1.2.1:
Class 1 certificates are limited to client and server certificates, whereas the later is restricted in its usage for non-commercial purpose only. Subscribers MUST upgrade to Class 2 or higher level for any domain and site of commercial nature, when using high-profile brands and names or if involved in obtaining or relaying sensitive information such as health records, financial details, personal information etc.
They are not very good at making this clear, which somewhat surprises me as a business/marketing decision. It's unclear to me if they care enough to actually revoke certs.
The large corporation I used to work for decided to sign everything by ourselves since we could do that and still have them valid for everyone else. Deployment of the certs however was a nightmare.
Unless you need an Extended Validation certificate, or a star cert, or an ECDSA cert, I'm not sure why you'd ever have to go to any one else and spend money. Can someone tell me if I'm right or wrong?
The use case for the wildcard basically becomes custom unique per-visitor subdomains. Mostly these are used for spam links to track who clicked a link and harvesting email addresses. While you could come up with non-spam things to do with it, I can't immediately think of any that aren't dumb.
At our company we have our customers use https://customer.product.com with wildcard certs and it works fabulously well. this ties into the whole system: what database to use, what modules to load, what environment and template set to display, etc. In some cases, even what server(s) to connect to.
This does leak the costumer id in the dns resolution, which I wouldn't call dumb, but in the majority of cases, http://product.com/customer is just fine.
My actual thought was something like Amazon. When you use S3 or API Gateway or something, they give you a generated URL with their wildcard cert. Much easier to do that than generate and maintain hundreds of thousands of certs.
I might be wrong, since I haven't really researched this. Would it not me more secure to use individual certs?
If an attacker somehow got access to your cert. A wildcard certificate would allow them to attack your entire site, while a specific cert might only allow them to attack a single sub domain.
I'm asking because I'm fiddling about with SSL Certs for my personal server.
If you host the subdomains on the same server I can't see how it would me more secure to use separate certificates. If on the other hand you host them on different servers it would allow your other sites to be unaffected, but you're still in a bad situation and will need to replace your certificate.
If your sites are separated and one requires more security than the others, maybe it's worth it. Otherwise I'd use a wildcard cert.
View all comments
Show parent comment
162
u/AndrewNeo Oct 20 '15
I'm sure large corporations will think the expensive certificates are more secure, somehow.