Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Is there a registar that offers SSL certificates for:

..domain.com

or

something_fixed.*.domain.com?

--

M.

share|improve this question
5  
Wouldn't *.example.com cover *.*.*.*.*.*...*.example.com? –  ceejayoz Apr 11 '10 at 21:15
    
Not a chance. This was the behaviour of mozilla browsers until relatively recently, but it violated the RFC and they fixed it. –  Falcon Momot Jun 23 at 21:52

3 Answers 3

Actually, wildcards only work on the first level of a subdomain in most browsers. So a wildcard certificate for *.example.com wouldn't work on mail.test1.example.com.

Web browsers also don't know what to do with a certificate for somthing.*.example.com either. You best option is to get a SAN certificate that you can include the specific hostnames in no matter what level they are on.

share|improve this answer
    
"wildcards only work on the first level of a subdomain in most browsers". Do you have any references for this? I'm not disputing, just curious. –  John Gardeniers Apr 12 '10 at 4:39
4  
Certainly. RFC2818 (ietf.org/rfc/rfc2818.txt) states: "If more than one identity of a given type is present in the certificate (e.g., more than one dNSName name, a match in any one of the set is considered acceptable.) Names may contain the wildcard character * which is considered to match any single domain name component or component fragment. E.g., .a.com matches foo.a.com but not bar.foo.a.com. f.com matches foo.com but not bar.com." –  Robert Apr 13 '10 at 7:03
    
+1 Wildcard certs do indeed only work for the first level subdomain. –  Tatas May 17 '10 at 15:28

In case it helps anyone, double wildcard certs don't actually work...

(from firefox) www.test.example.com uses an invalid security certificate.

The certificate is only valid for ..example.com

(Error code: ssl_error_bad_cert_domain)

share|improve this answer

As ceejayoz says - a standard wildcard certificate will do exactly what you desire.

I assume you're looking for that style of certificate because you want something cheaper? If so, then no can do, you have to purchase a wildcard.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.