1

I need one self signed certificate to cover multiple URLs, which could be represented by the following:

*.foo.com
*.faa.fii.bar.com

Using alternate names I managed to create such a certificate, but I get a certificate error from the browser when accessing

bla.foo.com

I created another certificate for ****.faa.fii.bar.com***, without ****.foo.com***. This time I gave alternate names for several other sites, but all belonging to bar.com.
So the common name was

*.faa.fii.bar.com

and alternate names were:

*.fii.bar.com
*.bar.com
*.fee.bar.com

This worked fine for any url which matches these patterns, so a.fii.bar.com or a.bar.com worked with the certificate. But if I add *.foo.com, which looks just like *.bar.com, then urls such as a.foo.com are not accepted, while a.bar.com is accepted.
How is this limitation defined?

1 Answer 1

0

The problem you're facing is that * in a certificate only matches a single sub-part of the fully-qualified name. So *.example.com matches a.example.com and xyzzy.example.com, but not foo.bar.example.com. To match further levels of FQDN, you need to add more asterisks, leading to certificates that have a great many subjectAltName entries, like:

*.example.com
*.*.example.com
*.*.*.example.com

And so on.

3
  • Maybe I wasn't clear enough in my example. In my case the CN was *.a.example.com . If I gave an alternate name *.b.example.com then a url such as z.b.example.com worked fine. But if I added an alternate name such as *.b.somethingelse.com, then a url such as z.b.somethingelse.com gave an error.
    – rimono
    Sep 21, 2011 at 9:27
  • Then you were doing it wrong. Perhaps forgetting the dns: at the beginning of the subjectAltName entry.
    – womble
    Sep 23, 2011 at 11:58
  • You are right. I was indeed doing it wrong. I now got this to work, and its very helpful. How about a wildcard in the middle - e.g. a.*.example.com . Could that work? Could I then use a URL such as a.b.example.com?
    – rimono
    Sep 25, 2011 at 11:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .