up vote 3 down vote favorite
share [g+] share [fb]

When I open https://amazon.com in Firefox, I get an "Untrusted Connection" message because the SSL certificate presented by amazon.com is only valid for www.amazon.com. Why don't I get the same message when I open google.com using SSL?

As I understand the output of

openssl s_client -connect google.com:443 | openssl x509 -noout -text

the certificate presented by google.com uses www.google.com as the common name, and doesn't include any subject alternative names or wildcards. What am I missing here?

link|improve this question
feedback

4 Answers

up vote 3 down vote

Your command line is incorrect. Browsers send the Server Name Indication extension to let the server use the correct certificate. If you do that in this case:

$ openssl s_client -servername google.com -connect google.com:443 | openssl x509 -noout -text

You get a certificate with a Subject Alternate Name (SAN) for google.com.

(Conversely, if you use IE on Windows XP, which doesn't send the SNI extension, you'll get the default certificate.)

link|improve this answer
feedback
up vote 1 down vote

The certificate is issued to *.google.com which means it is valid for any prefix.

link|improve this answer
But I don't see *.google.com in the output of openssl s_client -connect google.com:443 | openssl x509 -noout -text and anyway I understand *.google.com wouldn't match google.com. – Mdebe Aug 15 '10 at 15:09
feedback
up vote 1 down vote

Some issuers let you use the SSL certificate with your www.domain.com and the base domain - without charging you more money, that way you can secure both www.domain.com and domain.com

http://nayyeri.net/ssl-certificates-and-www-prefix-on-domain-names

On another end, since I am being redirected from https://google.com to http://www.google.com I cannot check if the SSL is a wildcard or not, but I guess this is a local thing.

link|improve this answer
Did you actually read the question? It's about ssl certificates working with and without the www subdomain, not about browsers recognising certain certificate authorities. – kaerast Aug 15 '10 at 9:49
In fact I did and just changed my answer. – Adam Benayoun Aug 15 '10 at 9:52
https://google.com redirects you to http://www.google.com, https://www.google.com doesn't. – Lazer Aug 15 '10 at 12:04
yes, this is exactly what I wrote - I was trying to check what SSL would be presented for google.com – Adam Benayoun Aug 15 '10 at 13:58
When I did the openssl command from the original question, I was expecting to see a subject alternative name of "google.com". With a common name of www.google.com and a SAN of google.com, the certificate would secure www.google.com and google.com as you say. But I didn't see a SAN (or a wildcard), so I asked the question in the hope that someone could explain how 1) I botched the openssl command, and therefore its output doesn't have anything to do with the certificate sent to Firefox, or 2) I misread the output of the openssl command and the certificate does in fact cover google.com. – Mdebe Aug 15 '10 at 15:54
feedback
up vote 1 down vote

A certificate has the usual Common Name (CN) which may include a wildcard and can sometimes have explicitly defined alternatives or even an entirely different domain be valid via Subject Alternative Names

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard