Issuing SSL certificates myself for subdomains of

Question

I guess it can't be done, but if so, I'd like to know why.

Let's say I get an SSL certificate for example.com from one of the official certificate authorities around. Let's also say I'm running a.example.com and b.c.d.example.com and would like to have SSL certificates for those as well.

Can I use the example.com certificate to issue certificates for a.example.com and b.c.d.example.com myself? And will they be recognized by users' browsers? If not, why not?

(My guess that it can't be done is because it would break the very lucrative wildcard cert business model, wouldn't it?)

Clarification: can't I act as a "self-signed" certificate authority using the keypair for which I obtained the official cert, and simply add my official cert in the validation chain?

Answer 1

You cannot use Your certificate to issue other certificates, because the purposes of the certificate are encoded in Your certificate and "Certificate Authority" is certainly not included in that list.

Web browsers check the "certificate chain" beginning from Your certificate, the certificate that was used to sign it, the signer of that certificate etc.

Your certificate must match the current use case (mostly "identify web site") and all signing certificates must include the "Certificate Authority" flag. The last certificate must be known to the browser (root cert).

As You already guess, wildcard certificates might help in Your case.

Answer 2

You're correct, you cannot issue certificates from a certificate. You need a Certificate Authority to issue certificates.

The whole point of a Certificate Authority is that they are a trusted 3rd party. CA's like Verisign are trusted by default by most browsers so that you dont have to manually accept certificates from them. They have what is termed a trusted root certificate.

If you create your own Certificate Authority and start dishing out certificates, web browsers will not know you and hance not trust you. The user will be prompted.