Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need one self signed certificate to cover multiple URLs, which could be represented by the following:


Using alternate names I managed to create such a certificate, but I get a certificate error from the browser when accessing


I created another certificate for *.faa.fii.bar.com, without *.foo.com. This time I gave alternate names for several other sites, but all belonging to bar.com.
So the common name was


and alternate names were:


This worked fine for any url which matches these patterns, so a.fii.bar.com or a.bar.com worked with the certificate. But if I add *.foo.com, which looks just like *.bar.com, then urls such as a.foo.com are not accepted, while a.bar.com is accepted.
How is this limitation defined?

share|improve this question

1 Answer 1

The problem you're facing is that * in a certificate only matches a single sub-part of the fully-qualified name. So *.example.com matches a.example.com and xyzzy.example.com, but not foo.bar.example.com. To match further levels of FQDN, you need to add more asterisks, leading to certificates that have a great many subjectAltName entries, like:


And so on.

share|improve this answer
Maybe I wasn't clear enough in my example. In my case the CN was *.a.example.com . If I gave an alternate name *.b.example.com then a url such as z.b.example.com worked fine. But if I added an alternate name such as *.b.somethingelse.com, then a url such as z.b.somethingelse.com gave an error. –  rimono Sep 21 '11 at 9:27
Then you were doing it wrong. Perhaps forgetting the dns: at the beginning of the subjectAltName entry. –  womble Sep 23 '11 at 11:58
You are right. I was indeed doing it wrong. I now got this to work, and its very helpful. How about a wildcard in the middle - e.g. a.*.example.com . Could that work? Could I then use a URL such as a.b.example.com? –  rimono Sep 25 '11 at 11:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.