Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to have a single webserver with a single certificate that hosts the following domains:

  • ...

In theory, I could create a certificate with the following characteristics:

  • Subject contains (*.)
  • SubjectAlternateName contains:
    • *
    • *

I tested this setup with and it seems to be working in a recent version of Firefox and IE8.


  • Should I expect client compatibility problems with this setup? Any known issues with e.g. IE6 or other older browsers?
  • Should I put * or simply to the Subject field in the certificate? (I know that in theory, when SubjectAlternateNames are present in a certificate, the browser should ignore the subject, in practice, I wish I knew what happens)
  • Are there any widely-trusted CAs who could create such a certificate for me?
share|improve this question
is there some reason you cant have a name such as: and ? your question doesnt reflect these possibilities. – djangofan Nov 22 '10 at 1:59
Well, the certificate should cover 250+ domain names with that * character. I think that explains it. – Zizzencs Nov 22 '10 at 18:34
Did you ever get a definitive answer? The question marked as "Answer" below doesn't seem to indicate an actual answer about whether the multiple wildcards can be in the SAN field. – jslatts Jan 29 '13 at 19:05
up vote 4 down vote accepted

I believe what you need is a SAN SSL Certificate (Subject alternative name), for instance, verisign has it

Also i heard about this a community that issues free certificates to you but i have no experience with it. But might worth a shot.


share|improve this answer
Unfortunately, CAcert in my experience isn't a viable option. Almost nobody uses them, as they don't have widespread inclusion in browsers. I and my group of Linux users here went through the process of becoming signers right when they first came out, but I honestly haven't had anyone asking about them in years. It's a great idea, but just doesn't have traction behind it, IMHO. – Sean Reifschneider Nov 16 '10 at 13:46
Yes, I would need a SAN certificate, where in the SAN field I have wildcard domains listed. – Zizzencs Nov 16 '10 at 14:22
CACert: As of today, I get a certificate warning when visiting a secure page on their own site Firefox says they cant be trusted. – Alph.Dev May 8 '15 at 14:22

It has always been possible to include multiple wildcards in a SN/SAN, but the majority of browsers added support for them in the last few years (around the time this question was originally asked). Now, you should have little trouble finding a Certificate Authority that will issue such a certificate, and most clients should accept it.

share|improve this answer

I would suggest to check GeoTrust True Business ID with Multi Domain which would work perfect for you. Though, it does not provide you to add wild card in SAN Certificate you can add up to 25 domains and they all are protected by single SSL Certificate.

You can check it at following URL:

Gaurav Maniar MCP | MCSE | MCST | MCITP | ITILv3 Certified

share|improve this answer

I wouldn't use wildcard certificates at all, as they can facilitate a ssl man-in-the-middle attack.

However, if you still want to :

  1. IE6 apparently had some issues dealing with these.

  2. Try different configurations with either a self-issued certificate authority or CACert. You will see what is the best between * and with SAN.

  3. Take a look at this page. It shows that all major certificate providers (comodo, digicert, thawte...) can provide wildcard certs.

share|improve this answer

I've been in shops that use Digicert for this very exact thing. Check out their WildCard plus certs.

share|improve this answer
Ah wait. I missed the part. I'll leave my answer up though as some might find it useful. – Belmin Fernandez Nov 22 '10 at 17:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.