Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have 3 web servers all located behind it`s own public IP. Is it possible to make a wildcard for example non *example.com in tinyCA, and how I proceed to get this to work?

I have searched google for help but has not found any good tutorial.

share|improve this question
    
If you know how to make one for example.com in TinyCA, then just swap that for *.example.com wherever you put example.com. Wildcards actually require the client to check them, as far as the certificate goes, it actually issues one to *.example.com without * having a meaning –  Jay Jun 23 '12 at 16:59

1 Answer 1

TinyCA is only an OpenSSL frontend, so if you search for it with openssl instead, you'll find more results.

Here is what I found:

mkdir /usr/share/ssl/certs/hostname.domain.com

cd /usr/share/ssl/certs/hostname.domain.com

(umask 077 && touch host.key host.cert host.info host.pem)

openssl genrsa 2048 > host.key

openssl req -new -x509 -nodes -sha1 -days 3650 -key host.key > host.cert
...[enter *.domain.com for the Common Name]...

openssl x509 -noout -fingerprint -text < host.cert > host.info

cat host.cert host.key > host.pem

chmod 400 host.key host.pem

(JustinSamuel.com)

Consider reviewing http://www.openssl.org/ the x509v3 certificate http://en.wikipedia.org/wiki/X.509 and joining the IRC channel on freenode for #openssl if you need realtime help. Most of the people on freenode on great.

However, back to the question at hand.

If you are operating web servers for yourself only, by all means, go with the self-signed route considering the cost. But, realize that many browsers are coming down harder on self-signed certs.

So, if you are serving to the public and want them to click on your site, or you are doing this for $, I'm going to recommend you get a commercial certificate instead.

References:

http://tinyca.sm-zone.net/

http://www.justinsamuel.com/2006/03/11/howto-create-a-self-signed-wildcard-ssl-certificate/

http://www.openssl.org/

http://en.wikipedia.org/wiki/X.509

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.