Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

You can make an SSL certificate by using * as the name.

But unfortunately, this doesn't cover

Is there any fix for this?

share|improve this question
up vote 7 down vote accepted

I seem to recall that * actually violates RFC anyways (I think only lynx complains though :)

Create a certificate with as the CN and * in the subjectAltName:dNSName names field - that works.

For openssl, add this to the extensions:

subjectAltName          = DNS:*
share|improve this answer
Awww, I just tried it and it doesn't work, at least in firefox. – Unknown Jun 3 '09 at 1:10
A detail: Ensure * is in the subjectAltName:dNSName field – MikeyB Jun 3 '09 at 2:58
@Supermathie how do I do that in the command line? – Unknown Jun 3 '09 at 3:38
You can't do it directly on the command line, but you can use -extfile and -extensions. – MikeyB Jun 3 '09 at 14:33
+1...this is how we handle our wildcard certificates. I can't commend on how to do this with openssl though. – Doug Luxem Jun 15 '09 at 3:01

Unfortunately you cannot do this. The rules for handling wildcards on subdomains are similar to the rules about cookies for subdomains.       matches    *    matches    *      does not match  *  does not match

To handle this you will have to obtain two certificates, one for * and the other for You will need to use two separate IP address and vhosts two handle these domains separately.

share|improve this answer
You can absolutely do this - its done all the time - see above answer. This is accomplished using the CN and the subject alternate name extension.… – John Kloian Aug 3 '15 at 22:08

Probably not the answer you're looking for, but I'm 99% sure there isn't a way. Redirect to and just use the * as the SSL cert. It's far from perfect, but should hopefully cover most of the cases you are interested in. The only other alternative is to use different IP addresses for and Then you can use different certificates for each IP.

share|improve this answer
You are correct. "" is a subdomian of ".com", so the wildcard that would work for it would be "*.com". This is why a cert for * works for "" but not, "". – sysadmin1138 Jun 3 '09 at 3:00

Wildcards these days will have * and in the subject alternative name field (SAN). For instance take a look at's wildcard SSL cert

You will see

Subject Alternative Names: *,

share|improve this answer
Just confirmed this on one of my own wildcard certs (from Comodo) - non-www worked just fine. – ceejayoz Jan 31 '13 at 21:15

No because they are completely different name space. redirecting the tld is not an option either because SSL is a transport encryption it has to decode the ssl before apache for example can even see the request host to redirect it.

Also as a side note: is also not valid for a wildcard cert (firefox from memory is the only one that will allow that.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.