WCF over HTTPS using a WildCard SSL Certificate

Question

We are the developers of a online in-browser management tool. Our primary software is currently hosted and accessible to our customers over the internet, every customer has its own primary software-instance and subdomain. For example customerA.ourdomain.com directs to a service for Customer A running on a virtual server. customerB.ourdomain.com directs to another service on the same or another virtual server and vice versa.

We are in the process of switching to Windows Phone and Store apps. Currently we have developed a WCF service and a WP app. The WCF service is running side-by-side with our primary software on one of our virtual servers and is accessible by a test subdomain. We have succesfully secured the connection between the app and service using a 90-day trail certificate. This certificate contains the full subdomain name.

We now would like to secure our WCF service by using a WildCard certificate, so each customer and/or subdomain is covered and we don't need to purchase a certificate for each customer.

Is this possible with WCF? Is this done before? The CN name will be *.ourdomain.com. Customers will connect with their phones to their own service by entering their own subdomain name. In other words: the WP app should be able to connect to a WCF service running on customerA.ourdomain.com or customerB.ourdomain.com using the same certificate.

Many thanks!

"The CN name will be *.ourdomain.com..." - placing DNS names in the CommonName is deprecated by both the IETF and CA/B Forums. Perhaps it would be better to place the DNS names in the SubjectAltNames. — jww
"Is this possible with WCF?..." - you can test with a StartCom Class 1 certificate. They are a commercial CA, they offer free Class 1 certs, and trusted by most desktop and mobile browsers. Once you test with test.ourdomain.com, you can then upgrade to a wild carded cert. StartCom charges for Class 2 and higher (and they charge for revocation, even on Class 1). — jww

wal wal · Accepted Answer · 2014-06-24T13:25:09

Is this possible with WCF? Is this done before?

Yes, we have been using a wildcard certificate from DigiCert successfully for a number of years

They provide a utility to ensure the certificate installs correctly.

In terms of WCF config its similar to what you would already have

<serviceCredentials>
    <serviceCertificate x509FindType="FindBySubjectName" findValue="*.ourdomain.com" storeLocation="LocalMachine" storeName="My"/>
</serviceCredentials>

On a related note you can produce your own wildcard certificate (for testing purposes) which works by populating the SubjectAltNames field

WCF over HTTPS using a WildCard SSL Certificate

1 Answers