0

If I have a certificate which is issued to *.abc.dk, I can get to the site with for example vm.abc.dk fine (changes automatically to https://www.vm.abc.dk) but when I try to write www.vm.abc.dk I get the error SSL_ERROR_BAD_CERT_DOMAIN in Firefox and similar error in Chrome.

If I choose to proceed or add an exception, it is able to redirect to https://vm.abc.dk fine. Do I need to add a SAN to my certificate, or what is the reason that I can't connect instantly with www.vm.abc.dk?

2 Answers 2

1

I believe a wildcard cert is only valid for anything at that sub-domain and no other lower sub-domain.

Ie. *.abc.dk is anything.abc.dk But will not work with any.thing.abc.dk For this you would need *.thing.abc.dk

Because you are requesting www.*.vm.abc.dk then the cert is not valid and is why you get the SSL_ERROR_BAD_CERT_DOMAIN error.

You could add a SAN which would probably be best, unless someone else has a better idea.

2
  • I'm requesting www.vm.abc.dk, and not www.*.vm.abc.dk. Should *.vm.dk still not "cover" this? Or do you need to add a SAN to support the www prefix?
    – Force444
    Jun 27, 2016 at 10:05
  • It is valid for *.abc.dk only not for www.vm.ABC.dk. Jun 27, 2016 at 11:42
1

You need a certificate which is valid for vm.abc.dk and www.vm.abc.dk.

  • So, if you want to go the wildcard way, get a cert including:

    • *.abc.dk
    • *.*.abc.dk

    Edit: According to Steffen Ullrich in the comments, this is not possible. Thanks for the hint!

  • or, if this is cheaper or there aren't that many subdomains involved, put all of them into the Subject Alternative Name field.

4
  • 3
    There can only be a single wildcard and this only matches the leftmost label. Thus *.abc.dk is possible, *.*.abc.dk or www.*.abc.dk are not. Jun 27, 2016 at 11:40
  • 1
    @SteffenUllrich Thanks for your comment. This isn't forbidden in the corresponding RFC, so technically this should be possible, but it's not supported by the browsers, right?
    – gxx
    Jun 27, 2016 at 12:12
  • 1
    RFC 2818 (HTTP-TLS) is not specific, But in RFC 6125 6.4.3 it says: "The client SHOULD NOT attempt to match a presented identifier in which the wildcard character comprises a label other than the left-most label (e.g., do not match bar.*.example.net).". Apart from that CA/Browser forum is relevant for the implementation in the browsers and what kind of certificates gets issued. Jun 27, 2016 at 14:18
  • @SteffenUllrich Thanks! I've incorporated these information into my answer.
    – gxx
    Jun 27, 2016 at 14:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .