You can simply add the alternate names to the certificate when signing. For example, if you use OpenSSL and you use the server_ca
section when signing (e.g. openssl ca -config my.conf -name server_ca -in server.req -out server.crt
) , make sure you have a section similar to the following in the config file you use when signing:
[server_ca]
...
x509_extensions = server_cert
[server_cert]
...
subjectAltName = @server_alt_names
[server_alt_names]
DNS.1 = subdomain.domain.com
DNS.2 = subdomain
To verify your certificate, pipe it to openssl x509 -noout -text
. You should see a line like this in the output:
X509v3 Subject Alternative Name:
DNS:subdomain.domain.com, DNS:subdomain
I saw the comment about SNI but if you just sign the certificate SNI will not matter at all (as long as both names are supposed to point to the same content). This method works for sure for Firefox and IE, not at all for Chrome and wget. In fact, the CN in the certificate does not even matter if you have the names listed as alternate names.
subdomain
as an alternative. Note that there might be some browser incompatibility with those methods, particularly with older browsers.subdomain
virtual host can just do a redirect tosubdomain.domain.com
. If you can do SAN, you might have broader compatibility: digicert.com/subject-alternative-name-compatibility.htm