up vote 7 down vote favorite
4
share [g+] share [fb]

You can make an SSL certificate by using *.domain.com as the name.

But unfortunately, this doesn't cover https://domain.com

Is there any fix for this?

link|improve this question
88% accept rate
feedback

4 Answers

up vote 6 down vote accepted

I seem to recall that *.domain.com actually violates RFC anyways (I think only lynx complains though :)

Create a certificate with domain.com as the CN and *.domain.com in the subjectAltName:dNSName names field - that works.

For openssl, add this to the extensions:

subjectAltName          = DNS:*.domain.com
link|improve this answer
Awww, I just tried it and it doesn't work, at least in firefox. – Unknown Jun 3 '09 at 1:10
A detail: Ensure *.domain.com is in the subjectAltName:dNSName field – MikeyB Jun 3 '09 at 2:58
@Supermathie how do I do that in the command line? – Unknown Jun 3 '09 at 3:38
You can't do it directly on the command line, but you can use -extfile and -extensions. – MikeyB Jun 3 '09 at 14:33
+1...this is how we handle our wildcard certificates. I can't commend on how to do this with openssl though. – Doug Luxem Jun 15 '09 at 3:01
feedback
up vote 7 down vote

Unfortunately you cannot do this. The rules for handling wildcards on subdomains are similar to the rules about cookies for subdomains.

www.domain.com       matches    *.domain.com
secure.domain.com    matches    *.domain.com
domain.com      does not match  *.domain.com
www.domain.com  does not match  domain.com

To handle this you will have to obtain two certificates, one for *.domain.com and the other for domain.com. You will need to use two separate IP address and vhosts two handle these domains separately.

link|improve this answer
feedback
up vote 2 down vote

Probably not the answer you're looking for, but I'm 99% sure there isn't a way. Redirect http://domain.com/ to https://www.domain.com/ and just use the *.domain.com as the SSL cert. It's far from perfect, but should hopefully cover most of the cases you are interested in. The only other alternative is to use different IP addresses for domain.com and www.domain.com. Then you can use different certificates for each IP.

link|improve this answer
You are correct. "domain.com" is a subdomian of ".com", so the wildcard that would work for it would be "*.com". This is why a cert for *.domain.com works for "www.domain.com" but not, "www.acct.domain.com". – sysadmin1138♦ Jun 3 '09 at 3:00
feedback
up vote 1 down vote

No because they are completely different name space. redirecting the tld is not an option either because SSL is a transport encryption it has to decode the ssl before apache for example can even see the request host to redirect it.

Also as a side note: foo.bar.domain.com is also not valid for a wildcard cert (firefox from memory is the only one that will allow that.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.