I need to create a range of hostnames for clients of the format (live|test).(clientname).clients.example.org (e.g. live.xyzltd.clients.example.org) which each have their own separate VirtualHost container and run over HTTPS on Apache. Due to the number of sites and the scarcity of addresses, I can't assign one IPv4 per host, nor can I use Server Name Indication (support in current libraries is almost non-existant), and the number of changes to the hostnames means Subject Alternative Name is also out.

Ideally I'd just have a certificate for *.clients.example.org, as that would in theory cover everything, but isn't permitted by RFC 2818. However, since I know that the hostnames will always be of the form * . * .clients.example.org, is it possible to create a certificate which contains multiple wildcards to achieve this? I'll be using a self-signed certificate, so it doesn't matter if this isn't something which is offered on a commercial basis, so long as it's technically possible.


You can't create certificates with multiple wildcards, it breaks the way certificates are checked.

What you can do however is do *.clients.example.org since even if not permitted by RFC 2818 it's the way it'll actually work with most SSL clients.

  • *.clients.example.org won't work with most clients - Firefox and IE for starters. – pwaring Jan 19 '11 at 10:47
  • Well, then I must be wrong, I have a certificate like that working perfectly for those browsers :/ – lynxman Jan 19 '11 at 10:50
  • Depends on the browser version - FF used to support it and then changed (somewhere in the 3.5.x branch I think). – pwaring Jan 19 '11 at 10:53
  • It's working for me with Firefox 3.6.8, just double checked right now, but I have to agree with you that using wildcard certificates is a bit of a pain, the browser implementation is poor and gets you diverse results. – lynxman Jan 19 '11 at 11:01

You can't have multiple wildcard characters in the common name, but you can have multiple wildcard Subject Alternative Names. For example, you could add the following SANs:

*.xyzltd.clients.example.org *.abcltd.clients.example.org *.defltd.clients.example.org

However, if you only have two subdomains per client, this only cuts the number of names in half. You could change the naming scheme to be testxyzltd.clients.example.org so they would all be covered by one certificate for *.clients.example.org.

  • The problem with Subject Alternative Names is not the number of entries, but the number of changes - each time I add/remove a client I'd have to change the certificate. I think I'll probably end up going with xyzltd-test.clients.example.org, which is not as pretty and destroys the hierarchy but should work. – pwaring Jan 19 '11 at 17:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.