Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I open in Firefox, I get an "Untrusted Connection" message because the SSL certificate presented by is only valid for Why don't I get the same message when I open using SSL?

As I understand the output of

openssl s_client -connect | openssl x509 -noout -text

the certificate presented by uses as the common name, and doesn't include any subject alternative names or wildcards. What am I missing here?

share|improve this question

Your command line is incorrect. Browsers send the Server Name Indication extension to let the server use the correct certificate. If you do that in this case:

$ openssl s_client -servername -connect | openssl x509 -noout -text

You get a certificate with a Subject Alternate Name (SAN) for

(Conversely, if you use IE on Windows XP, which doesn't send the SNI extension, you'll get the default certificate.)

share|improve this answer

The certificate is issued to * which means it is valid for any prefix.

share|improve this answer
But I don't see * in the output of openssl s_client -connect | openssl x509 -noout -text and anyway I understand * wouldn't match – Mdebe Aug 15 '10 at 15:09

Some issuers let you use the SSL certificate with your and the base domain - without charging you more money, that way you can secure both and

On another end, since I am being redirected from to I cannot check if the SSL is a wildcard or not, but I guess this is a local thing.

share|improve this answer
Did you actually read the question? It's about ssl certificates working with and without the www subdomain, not about browsers recognising certain certificate authorities. – kaerast Aug 15 '10 at 9:49
In fact I did and just changed my answer. – Adam Benayoun Aug 15 '10 at 9:52 redirects you to, doesn't. – Lazer Aug 15 '10 at 12:04
yes, this is exactly what I wrote - I was trying to check what SSL would be presented for – Adam Benayoun Aug 15 '10 at 13:58
When I did the openssl command from the original question, I was expecting to see a subject alternative name of "". With a common name of and a SAN of, the certificate would secure and as you say. But I didn't see a SAN (or a wildcard), so I asked the question in the hope that someone could explain how 1) I botched the openssl command, and therefore its output doesn't have anything to do with the certificate sent to Firefox, or 2) I misread the output of the openssl command and the certificate does in fact cover – Mdebe Aug 15 '10 at 15:54

A certificate has the usual Common Name (CN) which may include a wildcard and can sometimes have explicitly defined alternatives or even an entirely different domain be valid via Subject Alternative Names

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.