Wildcard Certificates
This page explains why Wildcard SSL certificates are not supported on and may not be used for UCSD systems and suggests a number of alternatives.
This page outlines why wildcard SSL certificates are not supported for UC San Diego systems and provides secure alternatives.
Certificate Services
SSL certificates are provided to UC San Diego faculty and staff at no cost, with most requests fulfilled within 24 hours. Please refer to the official SSL request documentation for details.
The Risk of Wildcard Certificates
While standard SSL certificates validate a specific domain (e.g., bob.ucsd.edu), a wildcard certificate validates an arbitrary number of subdomains (e.g., *.bob.ucsd.edu).
Using wildcard certificates significantly increases security risks. If a single server using a wildcard certificate is compromised, attackers can spoof any host within that domain. This enables the creation of illegitimate, encrypted subdomains that appear valid, facilitating phishing campaigns and Man-in-the-Middle (MiTM) attacks.
Recommended Alternatives
To balance administrative convenience with security, UC San Diego recommends the following:
- Subject Alternative Name (SAN): This protocol allows a single certificate to be associated with multiple specific domains (typically up to 100).
- Directory-based Structures: For services hosting multiple instances (such as blogs), use a directory format (e.g., wordpress.ucsd.edu/bob) rather than custom subdomains. Vanity URLs can be implemented via web server redirects to maintain marketing preferences while using a single domain certificate.
Exceptions and Emergency Requests
Exemptions may be granted for specific high-traffic chokepoints, such as load balancers or HPC clusters, or for short-term transitions. These requests are rarely approved and require formal risk acceptance from unit or college leadership.