title: Can I get an Intermediate Certificate to sign SSL Certificates for my own domain myself?
body: <p>I am maintaining a project with quite a large server infrastructure.</p>
  
  <p>At the moment I am using several SSL certificates for different subdomains, and that's not easy on the pocket.</p>
  
  <p>A far more economical solution for me would be to get one wild card certificate and use it on all of my servers. </p>
  
  <p>However those servers are spread across the globe, and if one of them gets compromised - physically or by any other means, the secret certificate key would fall into the hands of whoever gets into the system.</p>
  
  <p>In that case, if I used a wild card certificate, the key compromised key would also be the key for all other components of the system (because they have the same certificate).</p>
  
  <p>I do not want to compromise the SSL security of my main website because some unimportant edge server has been compromised.</p>
  
  <p>That's why I wondered whether I can sign my own CSR for my own subdomains somehow.</p>
  
  <p>Something like a "self service top level domain wide intermediate certificate authority"</p>
  
  <p>Is there such a thing? As far as I understand certificate authorities and intermediate certificate authorities are not limited to specific scopes on their common name (domain).</p>
  
  <p>However I know that for example Google on the fly generates certificates for security purposes on special parts of their website. </p>
  
  <p>I wonder how they do that. Or are they a certificate authority on their own?</p>
  
  <p>Hope the question is clear,
  any help is appriciated!</p>