Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

While configuring SSL and certificates in my Apache server I had some troubles with second-level-domains like

If I ask for a certificate for a domain it will be issued for and

If i ask for a certificate for it will only work for but not for (issued by RapidSSL)

Is there a technical reason for that?

share|improve this question
up vote 4 down vote accepted

Yes. For the uninitiated lets break this down into little pieces:

When you request a standard x509 Certificate with Server Authentication Extension (commonly called an SSL Cert) you must provide a Subject Name (SN). This SN must match what the user types in for the certificate to be used without a warning message.

Technically the certificate should only be good for the exact SN you provide to the CA. So if you request then it should only work for that domain name, it should not work for or anything besides

However, many websites also work on alternate domain names. It is very common for the default domain name to work. So in the example; www is a host name, and is a domain name. The certificate was requested for and issued to, and as established in the previous paragraph this does not match (because is requesting the default host (A) record for the domain; it should be very apparent that the host www and the default host are not the same in a DNS sense, and certainly do not have to be the same website even).

Most people actually have the same website on both host names. Further most users expect that they can type either name in and the correct website will appear. Because of this most CAs do not issue the certificate you requested. They actually issue a certificate with the SN you provided (as above), and which also contains a Subject Alternate Name (SAN; which as the name implies provides alternate names that a user can type in and which should be accepted without a warning message). This most commonly only works when you request a 2rd level domain name (eg and they very commonly ignore www as a 3rd level domain name (eg becomes for the purposes of the certificate).

Commonly, when you request a certificate for or you actually get a certificate with a SN of and a SAN of The TLD can usually be anything.

But, when you request a cert with a more specific name, such as your example (from the Question) where there are 4 levels (or more) of domain name, they do not include this alternate name.

You can specifically request one. Sometimes simply by asking them they'll issue it without additional charge. Other times you have to request a UCC or Multiple SAN certificate (same thing, different names). A wildcard cert would also work, though they tend to be more expensive and commonly require a higher degree of purchaser authentication.

share|improve this answer
that's inconsistent with the example above where when you request for a .com domain it will work both for www and without www. – GriffinHeart Oct 20 '11 at 14:16
@GriffinHeart That has nothing to do with whether it's a .com or not, and everything to do with the alternate name attribute that the certificate authority adds to the certificate, as Chris said - the fact that it has more levels to the name is likely altering the certificate authority's default behavior. – Shane Madden Oct 20 '11 at 14:22
@GriffinHeart Please see the revised answer, which hopefully is more clear. – Chris S Oct 20 '11 at 14:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.