1

I have a webserver in my intranet which can be accessed via subdomain.domain.com and simply subdomain. The SSL certificate is created for subdomain.domain.com which results in a warning as soon as I access just subdomain via https.

Any idea how this can be solved? (yes, I don't know much about ssl server configuration :-)

5
  • 1
    How are you signing the certificates?
    – cjc
    Nov 2, 2012 at 10:05
  • selfsigned - don't ask about the details...
    – rdmueller
    Nov 2, 2012 at 10:08
  • 3
    Look for Server Name Indication (SNI) or Subject Alternate Name (SAN) capability in your signing or request generation. You should be able to just submit subdomain as an alternative. Note that there might be some browser incompatibility with those methods, particularly with older browsers.
    – cjc
    Nov 2, 2012 at 10:16
  • hm. It seems sthat there is a problem with SNI and IE on XP...
    – rdmueller
    Nov 2, 2012 at 12:42
  • 2
    Yes. IE on XP would be an issue. Hmm. It's an intranet. Do you control IP allocation? If so, and you're supporting browsers that don't play well with SNI, you might just set up a second IP address on that machine, and deal with it the old fashioned way: one cert per IP address. The subdomain virtual host can just do a redirect to subdomain.domain.com. If you can do SAN, you might have broader compatibility: digicert.com/subject-alternative-name-compatibility.htm
    – cjc
    Nov 2, 2012 at 13:43

1 Answer 1

5

You can simply add the alternate names to the certificate when signing. For example, if you use OpenSSL and you use the server_ca section when signing (e.g. openssl ca -config my.conf -name server_ca -in server.req -out server.crt) , make sure you have a section similar to the following in the config file you use when signing:

[server_ca]
...
x509_extensions = server_cert

[server_cert]
...
subjectAltName = @server_alt_names

[server_alt_names]
DNS.1 = subdomain.domain.com
DNS.2 = subdomain

To verify your certificate, pipe it to openssl x509 -noout -text. You should see a line like this in the output:

        X509v3 Subject Alternative Name: 
            DNS:subdomain.domain.com, DNS:subdomain

I saw the comment about SNI but if you just sign the certificate SNI will not matter at all (as long as both names are supposed to point to the same content). This method works for sure for Firefox and IE, not at all for Chrome and wget. In fact, the CN in the certificate does not even matter if you have the names listed as alternate names.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .