63
votes
Wildcard SSL certificate for second-level subdomain
All answers here are outdated or not fully correct, not considering the RFC 6125 from 2011.
According to the RFC 6125, only a single wildcard is allowed in the most left fragment.
Valid:
*.sub.domain....
- 1,759
41
votes
Accepted
What is the difference between 0.0.0.0/0 and 0.0.0.0/1?
The 0.0.0.0/0 matches every IP address, whereas 0.0.0.0/1 only matches half of them (0.0.0.0-127.255.255.255) and requires 128.0.0.0/1 as its pair to match the rest (128.0.0.0-255.255.255.255).
In ...
- 49.8k
38
votes
Accepted
Nginx wildcard/regex in location path
The = modifier in location block is an exact match, without any wildcards, prefix matching or regular expressions. That's why it doesn't work.
On your regex attempt, [a-z] matches a single character ...
- 37.6k
17
votes
Accepted
Difference between wild card SSL
A wildcard covers only one level. So *.example.com will cover foo.example.com, bar.example.com, and staging.example.com but not foo.staging.example.com or example.com.
However you can have multiple ...
- 4,296
12
votes
Difference between wild card SSL
A wildcard only matches one domain level, so *.staging.example.com would not be matched and you need another cert for subdomains of it.
https://en.wikipedia.org/wiki/Wildcard_certificate
- 99.6k
12
votes
Wildcard vhosts on Nginx
This Nginx configuration file below allows for wildcard hostnames that dynamically route to the corresponding folder in /var/www/vhost/ while also dynamically generating the respective log files.
...
- 238
10
votes
What is the difference between 0.0.0.0/0 and 0.0.0.0/1?
What is the difference between 0.0.0.0/0 and 0.0.0.0/1
0.0.0.0/0 matches all IPv4 addresses.
0.0.0.0/1 matches the IP range from 0.0.0.0 to 127.255.255.255
IP routing uses a "longest prefix ...
- 4,296
10
votes
Accepted
Wildcard A record overwriting specific A record for subdomain
Wildcards do not override regular records, however at least in the obfuscated example it looks like the more specific regular record that you speak of is very likely not named as was intended.
www ...
- 35.5k
8
votes
Accepted
LetsEncrypt certificate for nested wildcard subdomain
The CertBot error you're seeing is accurate - SSL certificates are only valid for one domain layer - for example *.domain.com or *.fr.domain.com or *.example.domain.com. More information - ...
- 9,680
6
votes
Wildcard DNS with BIND
To set a subdomain wildcard in bind you should use the following format:
name.tld. IN A IP # main domain ip
*.name.tld. IN A IP # wildcard subdomains ip
Example:
mydomain.com. IN A ...
- 479
5
votes
Accepted
Globbing based on current directory
This is because the result of the *mysql* globbing depends on the content of the directory you are in. Your shell interprets the * character (unless you escape it or hide it in quotes) by trying to ...
- 3,577
5
votes
Accepted
(Self-signed) certificate with wildcards for localhost IPs (127…)
I assume that you are attempting to add the wildcard IP addresses as a Subject Alternate Name and not as the Subject (which doesn't allow IP addresses at all).
RFC5280 Section 4.2.1.6 states:
For IP ...
- 4,789
5
votes
wildcard dns not working properly
It sounds like everything is working as intended and that the confusion here stems from not knowing how DNS wildcards are supposed to work.
The wildcard matches any names below the point of wildcard ...
- 35.5k
4
votes
Wildcard SSL certificate for second-level subdomain
although i'm not looking into your question, i just happened to read something about it minutes ago:
https://www.instantssl.com/articles/can-you-create-a-wildcard-ssl-certificate-for-two-levels.php
...
- 143
4
votes
Accepted
nginx sub directory wildcard rewrite
I cannot attest whether what you want to do will work, but below is the conversion of your "pseudocode" into actual nginx configuration (and provided that a likewise copy-paste solution was working ...
- 14.3k
4
votes
It´s possible to use a wildcard SSL certificate in SFTP/SSH connection?
no. SSH/SFTP is not using SSL certificates, but SSH certificates or keys (unless you have specially crated SSH server and clients supporting this).
But you can configure this way FTPs server for ...
- 10.1k
4
votes
Accepted
Why does Firefox show SSL_ERROR_BAD_CERT_DOMAIN with a self-signed wildcard certificate, but other browsers do not?
Your certificate has the following "Subject Alternative Names" (SAN):
DNS:*.mainserver.local
DNS:*.mainserver
DNS:*.mgmt.ctb.co.at
IP:192.168.0.254
IP:192.168.0.9
IP:192.168.10.254
IP:192....
- 116
4
votes
Accepted
ERR_CERT_COMMON_NAME_INVALID with internal AD CA wildcard
Answer(s):
I needed to also populate a SAN with a wildcard entry, and also move from SHA1 to SHA256.
- 1,753
4
votes
Accepted
Are wildcard certificates allowed for a top-level domain
Certificates are designed to identify a single administrative entity. With public top level domains there is no single administrative entity for things like *.com, only for *.example.com or even more ...
- 13.7k
4
votes
Wildcard DNS entry is broken by more specific (but non-matching) DNS entry
It looks like this situation is covered by section 2.2.2 in RFC 4592 (https://www.rfc-editor.org/rfc/rfc4592), which states that the record dummy.api.example.com results in the implicit existence of ...
3
votes
DigitalOcean DNS can new cname record conflict with existing wildcard cname record
A specific entry always overrides a wildcard, so app.domain.com will take priority on *.domain.com
See chapter 4.3.3 of RFC 1034.
Wildcard RRs do not apply:
When the query is in another zone. That ...
- 918
3
votes
Accepted
DNS: cname wildcard entry subdomain with hyphen
That's not going to work. A wildcard must cover a whole "domain level", you can't use it to match parts of a domain. See this and RFC 1034.
- 99.6k
3
votes
Accepted
different ssl cerfiticate for subdomain
This depends on the webserver you're using.
Make sure it supports SNI (Server name indication) (which is the case on propably all relevant webservers) or use a reverse proxy like nginx or haproxy to ...
- 1,022
3
votes
Accepted
Is a wildcard CNAME DNS record valid in multi sub-domains?
Your first record is mostly fine, though I would add an explicit TTL like this (using 30 minute TTL as an example):
*.a 1800 IN CNAME example.com.
For the other records I would do the ...
- 30.7k
3
votes
Accepted
Nginx subdirectory try_files wildcard always fail
The regular expression location blocks are evaluated in order, so the .php block must be placed before the /test/... block, otherwise the .php files under /test/ will be downloaded instead of being ...
- 13.4k
3
votes
Dovecot SSL certificate -> Cert Hostname DOES NOT VERIFY
It is unclear what you actually checked and what your certificate contains. But the link to www.checktls.com you've provided is for a site which checks the capabilities of the SMTP server, i.e. the ...
- 13.7k
3
votes
Accepted
Dynamic Error and Custom logs in apache 2 using wildcard subdomains
At the risk of giving you more work, you may also want to consider going the opposite direction and combining ALL of your logfiles into syslog. It seems more intimidating but it's a much more capable ...
- 598
2
votes
Is a wildcard DNS record bad practice?
Another issue here is the SEO: if all *.example.com showing the same content, your website will be badly referenced, at least by Google (https://support.google.com/webmasters/answer/66359).
2
votes
Is a wildcard DNS record bad practice?
There's one rather important crucially GOOD use of wildcard DNS: to block subdomain spam via spf!
Along with whatever else is configured, it is rather important to also set up:
*.example.com. ...
- 21
2
votes
Nginx wildcard/regex in location path
Order is important, from nginx's "location" description:
To find location matching a given request, nginx first checks locations defined using the prefix strings (prefix locations). Among them, the ...
- 646
Only top scored, non community-wiki answers of a minimum length are eligible