up vote 0 down vote favorite
share [g+] share [fb]

I am attempting to create a wildcard SSL cert with a Subject Alternative Name (SAN) for use in IIS 7.5 and I'm having some issues. Because I need to include a SAN, I am using the Custom Certificate Request tool under the Certificates snap-in on Windows.

Thus far, I have managed to get a working wildcard certificate when I use the IIS 7.5 Create Certificate Request wizard, and a working SAN certificate when I use the Custom Certificate Request wizard (in the Certificates snap-in), but I have been unable to get both working in the same cert.

The cert which I generated with the Custom Certificate Request wizard has the following properties:

Subject Name:

  • CN=*.domain.local

Alternative Name:

  • DNS=domain.local

Extended Key Usage:

  • Server Authentication

(Private) Key Type:

  • Exchange

(Private) Key Options:

  • Key size: 2048
  • [x] Make private key exportable

With the above cert in IIS 7.5, requests to the SAN of https://domain.local are secure, but https://*.domain.local requests are unsecure with the browser stating that the cert is only valid for domain.local (instead of *.domain.local).

Ultimately, my objective is to have a cert which works on *.domain.local and domain.local.

Using the Custom Certificate Request wizard in the Windows Certificates snap-in, how can I create a certificate request for a cert containing a wildcard and a SAN attribute?

link|improve this question
50% accept rate
What do the subject and subject alternate name attributes on the certificate look like? – Shane Madden Feb 2 at 4:50
@ShaneMadden They are exactly as defined in the request. – Nathan Taylor Feb 2 at 5:21
1  
This is exactly how it is supposed to work. Perhaps you should post your request and certificate files in PEM format for further examination – syneticon-dj Feb 2 at 7:04
@syneticon-dj Do you happen to know how i can export my request as PEM? The only option I'm given with the request wizard is Base64 or Binary output. – Nathan Taylor Feb 2 at 18:47
1  
PEM is Base64 encoded as well, but you are right, you do not get it as an export choice. I was just aiming at the fact that it should be ASCII-only so it could be published easily, so feel free to export in any Base64-encoded format and pasting into your question. Make sure not to export the private key :) – syneticon-dj Feb 3 at 7:53
feedback

1 Answer

up vote 1 down vote accepted

When a subject alternative name is in place, the common name (edit: from the subject) is no longer used. Solution: Add the wildcard name to the list of subject alternative names.

link|improve this answer
This worked for me, thank you! – Nathan Taylor Feb 3 at 18:10
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.