Re: Multi-domain security certificate

Thomas Arnoux wrote:
> On Thu, 2009-01-22 at 11:12 +1100, David Banes wrote:
>> You need to get a wildcard certificate for 'foo.com'.
> 
> Hi David,

First of all, the best way to get your questions about the XMPP ICA
answered is to ping me via IM. That's why I put my name on the CA pages
at http://xmpp.org/ca/ :)

> Thanks for your answer, but I cannot have a a certificate for *.foo.com
> (I do not own/control foo.com, and its owner will give me access to only
> *.muc.foo.com and *.im.foo.com (or without the wildcards), not to
> *.foo.com).

StartCom (and therefore the XMPP ICA) will not issue certificates to
third-level and fourth-level domains, at least not directly, because we
cannot verify your association with the first-level domain. The only way
to do this is to convince the owner of the first-level domain to let you
request such a cert (e.g., the verification message will go to an email
address such as [email protected] and the person who controls that
inbox will forward the message to you). I don't know whether you have
that kind of trust relationship with the owner of the first-level domain.

> Documentation about all of this is very scarce, and the simplest process
> on startcom's website (with CSR generation) doesn't seam to allow
> creation of wildcards on the fourth level DNS name, nor multi-domain
> certificates.

Correct.

> Is it possible to get one single certificate for all domains (with and
> without their wildcards), or to use several certificates (with
> ejabberd)?

Not from StartCom via the XMPP ICA.

> Is the manual CSR generation exactly the same as for SSL certificates (I
> couldn't find anything else on Google)?

Yes. I'll add something about that to http://xmpp.org/ca/issuance.shtml

/psa

_______________________________________________
JAdmin mailing list
FAQ: http://www.jabber.org/discussion-lists/jadmin-faq
Forum: http://www.jabberforum.org/forumdisplay.php?f=19
Info: http://mail.jabber.org/mailman/listinfo/jadmin
Unsubscribe: [email protected]
_______________________________________________