Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've got a wildcard SSL certificate for *.mydomain.com.

I'm using nginx, and redirecting all traffic for http to https, and also rewriting the URLs without a trailing www (if there is one).

So it has,

1) http://subdomain.mydomain.com       ---> https://subdomain.mydomain.com 

2) http://www.subdomain.mydomain.com   ---> https://subdomain.mydomain.com 

3) https://www.subdomain.mydomain.com  ---> https://subdomain.mydomain.com

4) https://subdomain.mydomain.com      ---> https://subdomain.mydomain.com

However, since my cert is for *.mydomain.com, case 3 gets an SSL error in chrome ('This is probably not the site that you are looking for!'), but if you click through it gets redirected and all is well.

I understand why, since the initial connection is for https with a www (2 levels of subdomains), which doesn't match what is on the wildcard certificate.

I thought a solution would be to get an additional cert for *.*.mydomain.com to cover www.*.mydomain.com. But it seems like that won't work. I spoke to agents from namecheap and comodo, and both said *.*.mydomain.com was not possible. I also came across this: https://support.quovadisglobal.com/KB/a60/will-ssl-work-with-multilevel-wildcards.aspx

Is there a solution to this? To be able to cover www.*.mydomain.com?

share|improve this question
    
sort of similar to serverfault.com/questions/520168/… but defeats my purpose of getting a wildcard subdomain –  user173326 Jul 3 '13 at 14:58

3 Answers 3

up vote 3 down vote accepted

Wildcard certs only go one level deep. You will need to get a wildcard that also has subject-alternate names for all www.<subdomain>.example.com sites. This will allow the redirection to happen.

Any solution other than putting valid certs on the two-level-deep subdomains will not work, because the SSL handshake will always happen before any redirection or re-writing.

share|improve this answer
    
I've read about SAN before and understand it can cover multiple domains. Can it also do something like www.*.example.com? The reason I needed a wildcard, was because I am giving out subdomains to users. Thanks –  user173326 Jul 3 '13 at 15:52
    
It cannot. You can add SANs to wildcard certain but you can never have a wildcard in the middle like you want. This is why you almost never see anyone with the setup you are describing. –  MDMarra Jul 3 '13 at 16:05
    
Thanks. I was looking around for other sites that have setups similar to mine, like <subdomain>.uservoice.com, and they also get the warning I am trying to avoid. –  user173326 Jul 3 '13 at 16:12
    
This is similar to the problem that Stack Exchange itself is trying to solve. They have meta.<site>.stackexchange.com and haven't come up with a good way to handle SSL. I think they're probably going to throw a lot of money and some config management tools at it to automatically provision and install new certs when new sites are added. A single-cert solution just doesn't really exist for this kind of thing. –  MDMarra Jul 3 '13 at 16:14

Small workaround is to rewrite URLs before establishing SSL connection, but you will never get https://www.subdomain.mydomain.com working without a warning before you get certificate for this domain name. Something like that:

server {
 listen 111.222.333.444:80;
 server_name www.subdomain.mydomain.com;

 rewrite ^ https://$host$request_uri permanent;
}

server {
 listen 111.222.333.444:443
 server_name subdomain.mydomain.com
 ssl on;
 ...
}
share|improve this answer

The problem is how wildcard certs work. They only work on first-level subdomains as you're seeing. To work around this, you'd want to use a PTR record to point www.subdomain.domain.com to subdomain.domain.com and it should be invisible to the server.

share|improve this answer
    
A PTR record isn't going to help anything here. I think you may have meant CNAME, but even that won't help. DNS solutions can't fix this. –  MDMarra Jul 3 '13 at 15:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.