Innovate. Accelerate. Win.
September 18-19 | Las Vegas and Virtual
#MIMSummit2023 Join top security leaders looking to redefine what’s possible at the must-see industry event of 2023.
What is a Wildcard Certificate?
A wildcard certificate is a public key certificate (like SSL/TLS) that can be used on multiple subdomains, usually purchased from a trusted public certificate authority.
So, for example, if you had a wildcard certificate for venafi.com you could possibly cover:
- www.venafi.com
- mobile.venafi.com
- shop.venafi.com
- cloud.venafi.com
Why are wildcard certificates important?
I could use one wildcard certificate, whether it was SSL or TLS, and use it to secure my website for all these subdomains. Without a wildcard certificate, I would need one certificate for each of these subdomains to secure them all. In the case above I would have to buy 4 individual certificates and each one would be set to secure each of the 4 subdomains.
With a wildcard certificate purchase, you can usually also cover your "naked domain." This would mean that I could add venafi.com in addition to the 4 subdomains that my wildcard certificate already covers and now cover a 5th subdomain without any additional cost.
How are wildcard certificates used?
Wildcard certificates are typically used to cover all domains with the same registered root making it simple to administer. However, the flexibility that comes with utilizing wildcard certificates also creates significant security risks since the same private key is used across multiple systems, thereby increasing the risk of compromise across the organization:
- Compromised web server—using a wildcard certificate on public-facing webservers increases the risk that cybercriminals will use the webserver to host malicious sites for phishing campaigns.
- Stolen private key— gaining access to a wildcard certificate’s private key provides attackers with the ability to impersonate any domain for the wildcard certificate.
- Fake certificates—cybercriminals can trick a CA into issuing a wildcard certificate for a fictitious company. Once a hacker has the fictitious company’s wildcard certificates, the attacker can create subdomains and establish phishing sites.
Without proper security, control, and monitoring of wildcard certificates, they can be easily misused by cybercriminals to exploit the trust organizations have in wildcard certificates and use them in phishing attacks.