Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I can make a single SSL certificate for several different domain names:

www1.example.com
www2.example.com
www3.example.com

But *.example.com doesn't work.

How can I make a single SSL certificate for all sub domains within .example.com?


P.S. Here is the extension part of the generated certificate:

    X509v3 extensions:
        X509v3 Basic Constraints: 
            CA:FALSE
        X509v3 Key Usage: 
            Digital Signature, Non Repudiation, Key Encipherment
        X509v3 Subject Alternative Name: 
            DNS:*.example.com

It's simply not matched by any sub-domain under example.com by the browser.

share|improve this question
    
what are you using to make these certs? –  uSlackr Jun 7 '12 at 1:53
    
I'm using openssl 1.0.1c. –  Xiè Jìléi Jun 7 '12 at 1:59
    
How does it not work? Does the certificate generation fail? Does it succeed but the client reports a name mismatch? What is the error message? –  mgorven Jun 7 '12 at 3:34
    
Well, I can generate the certificate with * char in the domain name, but it's not matched. –  Xiè Jìléi Jun 7 '12 at 4:29
1  
That should work, but try setting *.example.com as the Common Name. –  mgorven Jun 7 '12 at 5:03
show 1 more comment

1 Answer

up vote 0 down vote accepted

This is a bit old but I am sure this process has not changed that much over the years

mkdir /usr/share/ssl/certs/hostname.domain.com
cd /usr/share/ssl/certs/hostname.domain.com
(umask 077 && touch host.key host.cert host.info host.pem)
openssl genrsa 2048 > host.key
openssl req -new -x509 -nodes -sha1 -days 3650 -key host.key > host.cert
...[enter *.domain.com for the Common Name]...
openssl x509 -noout -fingerprint -text < host.cert > host.info
cat host.cert host.key > host.pem
chmod 400 host.key host.pem

http://www.justinsamuel.com/2006/03/11/howto-create-a-self-signed-wildcard-ssl-certificate/

share|improve this answer
    
Welcome to Server Fault! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. –  mgorven Jun 7 '12 at 3:36
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.