I'm running a server "myserver.net", which has the subdomains "a.myserver.net" and "b.myserver.net".

When creating (self-signed) SSL certificates, I have to create one for every subdomain, containing the FQDN, even though those subdomains are just vhosts.

OpenSSL permits only one "common name", which is the domain in question. Is there any possibility to create a certificate that is valid for all subdomains of a domain?


Yes, use *.myserver.net as common name.

This is called wildcard certs and there are large number of howtos finding with this keyword.

Here is one of them: https://web.archive.org/web/20140228063914/http://www.justinsamuel.com/2006/03/11/howto-create-a-self-signed-wildcard-ssl-certificate

Update: if you want cert to match root domain as well (myserver.net), then you should use Subject Alternative Name extension. When generating cert using openssh enter '*.myserver.net/CN=myserver.net' as Common Name.

Compatibly is good enough, unless you have an ancient browser.


Just as an FYI, there is another kind of certificate as well called a Unified Communications Certificate. A wildcard can only be issued for *.domain.com but a UCC certificate allows you to list up to 100 Fully Qualified Domain Names(FQDN) under any domain. The main reason to get one of these is that Microsoft isn't too keen on the wildcards for things like MS Domain controllers, Exchange, etc.


A Unified Communications Certificate (UCC) is an SSL certificate that secures multiple domain names and multiple host names within a domain name. A UCC lets you secure a primary domain name and up to 99 additional Subject Alternative Names (SANs) in a single certificate. UCCs are ideal for Microsoft® Exchange Server 2007, Exchange Server 2010, and Microsoft Live® Communications Server.

UCCs are compatible with shared hosting. However, the site seal and certificate "Issued To" information will only list the primary domain name. Please note that any secondary hosting accounts will be listed in the certificate as well, so if you do not want sites to appear 'connected' to each other, you should not use this type of certificate.

The main downside to UCC is that you have to list all your domains up front (wildcards don't require this). If the list ever changes you'll have to get a new certificate. Incidentally, Namecheap (only one I know of that does this) offers an Extended Validation UCC(you pay per domain, which means a 100 domain certificate is VERY expensive), which is the only way to have an EV certificate for more than one domain, as nobody offers EV Wildcards.


It's a valid question. Unfortunately from what I understand the protocols never intended the owner of a domain to be able to sign certificates for just subdomains.

You are either a CA for anything or nothing. There is no limitation in scope once you are a CA.

Stupid but that's the way it is. Just buy a separate certificate for every single domain that you own $$$, that's right every single one, so don't bother trying to secure embedded devices that you sell.

  • 2
    No, this is wrong. First, see the other answer here, second, read up on what a certificate authority actually is. I have a CA for my internal domain only. There very much are scope limitations for CAs. – HopelessN00b Oct 11 '12 at 14:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.