Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a wildcard SSL for a certain domain, for question purpose let's say *.example.com. It works fine if I match a direct sub-domain like aaaa.example.com, but when I try to associate a sub-sub-domain like aaa.bbb.example.com, I get a security error in my browser saying

aaa.bbb.example.com and *.example.com mismatch

Is this the normal behavior or may I investigate further?

Just to help here is my CRT content :

-----BEGIN CERTIFICATE-----
MIIFGTCCBAGgAwIBAgISESH5zsC/3lJ1F9owE9tmDTj+MA0GCSqGSIb3DQEBBQUA
MF0xCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMTMwMQYD
VQQDEypHbG9iYWxTaWduIE9yZ2FuaXphdGlvbiBWYWxpZGF0aW9uIENBIC0gRzIw
HhcNMTIwODEzMDgxNTAyWhcNMTMwNzI1MTU0MTE5WjBhMQswCQYDVQQGEwJGUjEW
MBQGA1UECBMNSWxlLWRlLUZyYW5jZTEOMAwGA1UEBxMFUEFSSVMxFTATBgNVBAoT
DGNvbm5lY3RoaW5nczETMBEGA1UEAwwKKi5hZHRhZy5mcjCCASIwDQYJKoZIhvcN
AQEBBQADggEPADCCAQoCggEBALWn1m2ZqrOmZgssMNcu9+IqsFi1jLAmj0fdSRy/
H1X7f5aZX/HYw10UBTTb4M16UUM97RrQz18YHIyUvAT/vtFyWWSY1qQOQSLnAkGp
UCvkOeWqvm9dG0Lc8OPuhvjhp/m8GKkrvGM0XSzpMedgVMlnpO/dg6j2mHpZ7vnf
vM9p0eW4GOHwh4S0etWrj3ReMykFgGoHgNqrmChJ4OdiKzs7KxVamZQ5AieTJpHN
jlQYCi6IuZCRrLHOC6F4Ficjfgvl4ChQZDrSI1ob+WqMWtNIFc1QEY2U4A/fo75x
baFILMAZhD/wdbL9WvfVOMcUP98bobIrzs60uvzVIB+DMUUCAwEAAaOCAc0wggHJ
MA4GA1UdDwEB/wQEAwIFoDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBFDA0MDIGCCsG
AQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzAf
BgNVHREEGDAWggoqLmFkdGFnLmZygghhZHRhZy5mcjAJBgNVHRMEAjAAMB0GA1Ud
JQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjBFBgNVHR8EPjA8MDqgOKA2hjRodHRw
Oi8vY3JsLmdsb2JhbHNpZ24uY29tL2dzL2dzb3JnYW5pemF0aW9udmFsZzIuY3Js
MIGWBggrBgEFBQcBAQSBiTCBhjBHBggrBgEFBQcwAoY7aHR0cDovL3NlY3VyZS5n
bG9iYWxzaWduLmNvbS9jYWNlcnQvZ3Nvcmdhbml6YXRpb252YWxnMi5jcnQwOwYI
KwYBBQUHMAGGL2h0dHA6Ly9vY3NwMi5nbG9iYWxzaWduLmNvbS9nc29yZ2FuaXph
dGlvbnZhbGcyMB0GA1UdDgQWBBQeYAmRFj71H9Gd5vF4VXKa3ciAcDAfBgNVHSME
GDAWgBRdRrKNxEt0HLvt9XO2Orc4j3WefjANBgkqhkiG9w0BAQUFAAOCAQEAY+K4
KpGyAc+H1wEKBNZ5eET8WwNevDrtZtLD8EbUPBzHoJaMzQpob4r6ax9pR13zoN9Q
gjujbuKSAbCBCkoOAKbjKZj4CXTPc004TNsDutRqIXflhSV+uhBdU1FqS4Ec90GY
QKcLII3iRnnlm9xNFHc+uidt0JkYlR8KHwmuP22XTEP/UkQGfOtKEY1+UM8BhQRU
5PSdoZv64E1wvA6fgVmnqBixwwAqF/PFxExlLtEw0jfDLpU72vgJ1Wt0y2/SpF33
gsh0Vh+TtltjnqQu62aR7LUPCEfxXfIpUkPJeNgNQwDEk81UKcz7zZnwc4l2ebE8
+2qd7XzDj9OPiVwtlA==
-----END CERTIFICATE-----
share|improve this question

4 Answers 4

up vote 5 down vote accepted

From RFC 2818:

Matching is performed using the matching rules specified by [RFC2459]. If more than one identity of a given type is present in the certificate (e.g., more than one dNSName name, a match in any one of the set is considered acceptable.) Names may contain the wildcard character * which is considered to match any single domain name component or component fragment. E.g., .a.com matches foo.a.com but not bar.foo.a.com. f.com matches foo.com but not bar.com.

In order to work around this, UCC certificates, a.k.a. Wildcard certificates with Subject Alternate Names (SAN) have been introduced which allow you to specify (along with different domain names) multiple level subdomains as valid hostnames for the certificate. These certificates are supported by all of the major browsers.

share|improve this answer
    
My certificate has the following SAN declaration : Subject Alternative Names = *.example.com, example.com Is it good enough ? –  Nicocube Aug 14 '12 at 16:10
    
No, not for two-level (or more) subdomains. –  Garrett Aug 14 '12 at 16:23
    
Argl, what's the correct change to ask ? Subject Alternative Names = *.*.example.com, *.example.com, example.com ? –  Nicocube Aug 14 '12 at 16:28
1  
AFAIK, you can't use *.*.example.com but you can do *.sub.example.com. –  Garrett Aug 14 '12 at 16:42
    
Ok thanks for all the knowledge, I'll try to manage with that. ;) –  Nicocube Aug 14 '12 at 16:46

Wildcard certificates do not support sub-subdomains. In other words they are only good for the current domain level.

So if you buy a certificate for *.foo.com it will NOT also secure *.bar.foo.com.

There are various resources on-line including Verisign, GlobalTrust and others that explain this as well. It sucks I know!

share|improve this answer

This is expected behviour. Excerpt from RFC2818 - HTTP Over TLS:

Names may contain the wildcard character * which is considered to match any single domain name component or component fragment. E.g., *.a.com matches foo.a.com but not bar.foo.a.com. f*.com matches foo.com but not bar.com.

share|improve this answer

Further investigation of the certificate scope issue that caused your irritation:

Technically it is possible to create a certificate for *.*.domain.com, I did this myself, but browsers do not support this.

Test results and a bit more are mentioned in " Wildcard SSL certificate for second-level subdomain ".

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.