*.WildCard or Single Domain Certificate should be used for Exchange and other applications

Question

Hello Team We are using *.wildcard *.tls.com certificate for Exchange Server :-webmail.tls.com Subdomains of

1. Fileshare.tls.com
2. chart.tls.com
3. icon.tls.com

we got issues like penetration report test experts are recommended to use single domain

now we would like to know what is the best practice to use for Exchange Servers
*.Wildcard or Single domain of each applications?

Kindly advise

Answer 1

Hi @Sathishkumar Singh ，

now we would like to know what is the best practice to use for Exchange Servers *.Wildcard or Single domain of each applications?

From the perspective of Exchange severs, the best practice is to use as few certificates as possible, which usually means using SAN certificates or wildcard certificates.

More information, hopefully you can find the article below helpful:
Digital certificates and encryption in Exchange Server-Digital certificates and encryption in Exchange Server

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hi, I'd be happy to help you out with your question. Sorry for the inconvenience caused. I would recommend using a single domain certificate instead of a wildcard certificate for Exchange Server and other applications, especially if you are using them for external-facing services. Wildcard certificates can make it easier to manage certificates for multiple subdomains, but they can also pose security risks. Since wildcard certificates can be used for any subdomain under the domain covered by the wildcard, if one of your subdomains is compromised, an attacker could potentially use the wildcard certificate to impersonate other subdomains as well. Using a single domain certificate for each application provides more granular control and security, as each certificate can be issued specifically for the domain it is intended for. This can help to prevent unauthorized access and reduce the risk of certificate misuse. If you have any other questions or need assistance with anything, please don't hesitate to let me know. I'm here to help.

If the reply was helpful, please don’t forget to upvote or accept as answer, thank you.