Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When I open https://amazon.com in Firefox, I get an "Untrusted Connection" message because the SSL certificate presented by amazon.com is only valid for www.amazon.com. Why don't I get the same message when I open google.com using SSL?

As I understand the output of

openssl s_client -connect google.com:443 | openssl x509 -noout -text

the certificate presented by google.com uses www.google.com as the common name, and doesn't include any subject alternative names or wildcards. What am I missing here?

share|improve this question
add comment

4 Answers

Your command line is incorrect. Browsers send the Server Name Indication extension to let the server use the correct certificate. If you do that in this case:

$ openssl s_client -servername google.com -connect google.com:443 | openssl x509 -noout -text

You get a certificate with a Subject Alternate Name (SAN) for google.com.

(Conversely, if you use IE on Windows XP, which doesn't send the SNI extension, you'll get the default certificate.)

share|improve this answer
add comment

The certificate is issued to *.google.com which means it is valid for any prefix.

share|improve this answer
    
But I don't see *.google.com in the output of openssl s_client -connect google.com:443 | openssl x509 -noout -text and anyway I understand *.google.com wouldn't match google.com. –  Mdebe Aug 15 '10 at 15:09
add comment

Some issuers let you use the SSL certificate with your www.domain.com and the base domain - without charging you more money, that way you can secure both www.domain.com and domain.com

http://nayyeri.net/ssl-certificates-and-www-prefix-on-domain-names

On another end, since I am being redirected from https://google.com to http://www.google.com I cannot check if the SSL is a wildcard or not, but I guess this is a local thing.

share|improve this answer
    
Did you actually read the question? It's about ssl certificates working with and without the www subdomain, not about browsers recognising certain certificate authorities. –  kaerast Aug 15 '10 at 9:49
    
In fact I did and just changed my answer. –  Adam Benayoun Aug 15 '10 at 9:52
    
https://google.com redirects you to http://www.google.com, https://www.google.com doesn't. –  Lazer Aug 15 '10 at 12:04
    
yes, this is exactly what I wrote - I was trying to check what SSL would be presented for google.com –  Adam Benayoun Aug 15 '10 at 13:58
    
When I did the openssl command from the original question, I was expecting to see a subject alternative name of "google.com". With a common name of www.google.com and a SAN of google.com, the certificate would secure www.google.com and google.com as you say. But I didn't see a SAN (or a wildcard), so I asked the question in the hope that someone could explain how 1) I botched the openssl command, and therefore its output doesn't have anything to do with the certificate sent to Firefox, or 2) I misread the output of the openssl command and the certificate does in fact cover google.com. –  Mdebe Aug 15 '10 at 15:54
add comment

A certificate has the usual Common Name (CN) which may include a wildcard and can sometimes have explicitly defined alternatives or even an entirely different domain be valid via Subject Alternative Names

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.