Certificate management is a critical part of an organisation’s cyber security that cannot be ignored. Certificates are vital for protecting data transmitted between websites and users. If not properly managed, data could be at significant risk. One certificate option that organisations often consider is wildcard certificates, which provide some benefits but also carry security risks.
What Are Wildcard Certificates?
This type of Certificate allows a single certificate to secure multiple subdomains of a domain. For example, a wildcard cert for *.example.com would secure app.example.com, shop.example.com, support.example.com, etc. This can be more convenient than acquiring individual certificates for each subdomain.
The Pros of Wildcard Certs
- Cost Savings – Wildcard certs are generally less expensive than purchasing multiple single-domain certs
- Simplified Management – Only one certificate needs to be tracked, updated and renewed rather than dozens or hundreds.
- Flexibility – New subdomains are automatically covered without needing new certs issued.
The Cons of Wildcard Certs
- Increased Risk – If the private key is compromised, all associated subdomains are vulnerable. This provides a larger attack surface area.
- Limited Transparency – You cannot easily determine which subdomains are actively using the cert.
- Compatibility Issues – Some applications and services do not properly support wildcard certificates.
While the cost and management benefits were previously major advantages, the proliferation of free and automated certificate platforms has diminished these benefits substantially. Many organisations no longer find wildcard certificates worth the security tradeoffs.
The choice of using wildcards requires careful consideration of your security risks, compatibility requirements, and management needs. For most organizations, the increased risk and maintenance overhead may outweigh the remaining convenience benefits of wildcard SSL/TLS certificates.
FullProxy Recommends
At FullProxy we strongly advise against using Wildcard certificates as they can come with significant security risks. Offering a false sense of security wildcard certificates don’t guarantee that users are genuinely accessing the intended systems. User could unknowingly connect to outdated or inactive links or servers that are no longer serve any purpose. Using wildcards conceals potential server and DNS errors.
Wildcard certificates could potentially fall into the wrong hands of attackers who could exploit them. For advice on certificate management, and to find out more about our partnership with AppViewX.
Book a call with us here.
