up vote 1 down vote favorite
share [g+] share [fb]

I need one self signed certificate to cover multiple URLs, which could be represented by the following:

*.foo.com
*.faa.fii.bar.com

Using alternate names I managed to create such a certificate, but I get a certificate error from the browser when accessing 

bla.foo.com

I created another certificate for *.faa.fii.bar.com, without *.foo.com. This time I gave alternate names for several other sites, but all belonging to bar.com.
So the common name was

*.faa.fii.bar.com

and alternate names were:

*.fii.bar.com
*.bar.com
*.fee.bar.com

This worked fine for any url which matches these patterns, so a.fii.bar.com or a.bar.com worked with the certificate. But if I add *.foo.com, which looks just like *.bar.com, then urls such as a.foo.com are not accepted, while a.bar.com is accepted.
How is this limitation defined?

link|improve this question
feedback

1 Answer

up vote 0 down vote

The problem you're facing is that * in a certificate only matches a single sub-part of the fully-qualified name. So *.example.com matches a.example.com and xyzzy.example.com, but not foo.bar.example.com. To match further levels of FQDN, you need to add more asterisks, leading to certificates that have a great many subjectAltName entries, like:

*.example.com
*.*.example.com
*.*.*.example.com

And so on.

link|improve this answer
Maybe I wasn't clear enough in my example. In my case the CN was *.a.example.com . If I gave an alternate name *.b.example.com then a url such as z.b.example.com worked fine. But if I added an alternate name such as *.b.somethingelse.com, then a url such as z.b.somethingelse.com gave an error. – rimono Sep 21 '11 at 9:27
Then you were doing it wrong. Perhaps forgetting the dns: at the beginning of the subjectAltName entry. – womble Sep 23 '11 at 11:58
You are right. I was indeed doing it wrong. I now got this to work, and its very helpful. How about a wildcard in the middle - e.g. a.*.example.com . Could that work? Could I then use a URL such as a.b.example.com? – rimono Sep 25 '11 at 11:14
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.