We bought a wildcard certificate (*.example.com). I got an .pem file (included Cert and Key), like "wildcard.example.pem".

As Certification Tool, I choosed XCA. The plan is, to import the Wildcard Cert into XCA and do the CSR requests against this Wildcard Cert. I can generate Certificates and Keys with it (I tried it as template or as RootCA, but both doesn't work). I can load them in the Webservers, but the Browser's tell me still: "It is a Self Sign Cert, warning warning - help help ...." How is it possible to get propper Self Sign Certs with this structure, without warnings from FF, Chrome and other Browser's?

Is my plan total bogus and I disunderstand the walkthrough? How can I go on in this case?

2 Answers 2


All certificates have a setting saying what things the certificates can be used for. When you buy a certificate from a public CA - whether it's for a wildcard domain or not - that certificate is usually restricted to encryption, web server and client authentication.

That means that this certificate cannot be used to issue new certificates.

If you're going to issue certificates for in-house usage only, you should create a new self-signed certificate for use as a root CA cert. I'm not familiar with XCA, but usually there's some tool for doing that within the CA software.

If you're going to issue certificate for usage with external parties, I strongly advise you to contact a company that knows PKI to help you set it up properly. It's not easy and it's not cheap.

  • +1, Perhaps it's worth mentioning that the 'Key Usage' field/extension on the certificate lists the actions allowed for that particular key.
    – Haxiel
    Commented Apr 10, 2019 at 10:02
  • @Haxiel yes, properly speaking it's not the certificate that's restricted but the key used to sign the original CSR. I just couldn't think of a way to formulate it that would still make the issue clear for the poster.
    – Jenny D
    Commented Apr 10, 2019 at 16:26

To avoid those warnings you should install in browsers the certificate of your certification authority. Or install this selfsigned certificate and trust it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .