Separate certs for domain host after a wildcard cert has been issued

Help
1

So I think I have put myself in a corner. We use a wildcard cert (with extra SANs) from a large commercial CA to protect our domain (avon-schools.org). Our webfilter has the API's built-in to use a Let's Encrypt and to auto renew. I elected that option and configured it. Since our web filter has several appliances, we needed a wildcard cert to cover it(*.avon-schools.org). The cert was generated and applied. Now, I know that once the cert is created, it cannot be modified. My problem is that the new wilcard cert has no SANS. When I attempt to generate a new cert with WIN-ACME, it tells me that my hosts are already covered by another certificate. Can I generate individual certificates on Let's encrypt with the wildcard cert already out there? Example: host1.avon-schools.org, host2.avon-schools.org, etc...

2

There is no Let's Encrypt policy that would prevent you from creating a second cert with SANs that are covered by an earlier cert with a wildcard. The only enforced limitation is that LE won't allow SANs that would be covered by a wildcard in the same cert.

This might just be a well-meaning but annoying-for-you win-acme feature trying to help.

3

The wildcard certificate (https://crt.sh/?id=26828261412) does have a Subject Alternative Name (*.avon-schools.org), this means that you can use it as the certificate for your direct subdomains.

4

Thanks for the reply. So I can create other individual certificates no problem, I just cannot create an individual cert for a host that is listed as a SAN in another cert. Do I have that right?

5

Thanks for the reply Max. I do understand that I should be able to use the existing Let's Encrypt wildcard cert to encrypt my other sub-domains, however there is no way to export the wildcard cert from the filter appliance since it does the request and renewals al internally. Also, I think a few of the servers require that their hostname be in the SAN list as well.

6

No, the names in one cert do not affect the names in another cert.

In a single cert you cannot have a name that is included in a wildcard name. For example you cannot request a cert with these 3 names because the www name is covered by the wildcard.

example.com
*.example.com
www.example.com

See the Wildcard Certificates section in this old post for more details: ACME v2 Production Environment & Wildcards

Note also the wildcard name only covers that level. So, in the above cert you could have a name like www2.www2.example.com as well as other wildcards for different registered domain names as they do not overlap with a wildcard name in that cert.