Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need one self signed certificate to cover multiple URLs, which could be represented by the following:


Using alternate names I managed to create such a certificate, but I get a certificate error from the browser when accessing

I created another certificate for *, without * This time I gave alternate names for several other sites, but all belonging to
So the common name was


and alternate names were:


This worked fine for any url which matches these patterns, so or worked with the certificate. But if I add *, which looks just like *, then urls such as are not accepted, while is accepted.
How is this limitation defined?

share|improve this question

The problem you're facing is that * in a certificate only matches a single sub-part of the fully-qualified name. So * matches and, but not To match further levels of FQDN, you need to add more asterisks, leading to certificates that have a great many subjectAltName entries, like:


And so on.

share|improve this answer
Maybe I wasn't clear enough in my example. In my case the CN was * . If I gave an alternate name * then a url such as worked fine. But if I added an alternate name such as *, then a url such as gave an error. – rimono Sep 21 '11 at 9:27
Then you were doing it wrong. Perhaps forgetting the dns: at the beginning of the subjectAltName entry. – womble Sep 23 '11 at 11:58
You are right. I was indeed doing it wrong. I now got this to work, and its very helpful. How about a wildcard in the middle - e.g. a.* . Could that work? Could I then use a URL such as – rimono Sep 25 '11 at 11:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.