Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a webserver in my intranet which can be accessed via and simply subdomain. The SSL certificate is created for which results in a warning as soon as I access just subdomain via https.

Any idea how this can be solved? (yes, I don't know much about ssl server configuration :-)

share|improve this question
How are you signing the certificates? – cjc Nov 2 '12 at 10:05
selfsigned - don't ask about the details... – rdmueller Nov 2 '12 at 10:08
Look for Server Name Indication (SNI) or Subject Alternate Name (SAN) capability in your signing or request generation. You should be able to just submit subdomain as an alternative. Note that there might be some browser incompatibility with those methods, particularly with older browsers. – cjc Nov 2 '12 at 10:16
hm. It seems sthat there is a problem with SNI and IE on XP... – rdmueller Nov 2 '12 at 12:42
Yes. IE on XP would be an issue. Hmm. It's an intranet. Do you control IP allocation? If so, and you're supporting browsers that don't play well with SNI, you might just set up a second IP address on that machine, and deal with it the old fashioned way: one cert per IP address. The subdomain virtual host can just do a redirect to If you can do SAN, you might have broader compatibility: – cjc Nov 2 '12 at 13:43

You can simply add the alternate names to the certificate when signing. For example, if you use OpenSSL and you use the server_ca section when signing (e.g. openssl ca -config my.conf -name server_ca -in server.req -out server.crt) , make sure you have a section similar to the following in the config file you use when signing:

x509_extensions = server_cert

subjectAltName = @server_alt_names

DNS.1 =
DNS.2 = subdomain

To verify your certificate, pipe it to openssl x509 -noout -text. You should see a line like this in the output:

        X509v3 Subject Alternative Name: 
  , DNS:subdomain

I saw the comment about SNI but if you just sign the certificate SNI will not matter at all (as long as both names are supposed to point to the same content). This method works for sure for Firefox and IE, not at all for Chrome and wget. In fact, the CN in the certificate does not even matter if you have the names listed as alternate names.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.