Yes. For the uninitiated lets break this down into little pieces:
When you request a standard x509 Certificate with Server Authentication Extension (commonly called an SSL Cert) you must provide a Subject Name (SN). This SN must match what the user types in for the certificate to be used without a warning message.
Technically the certificate should only be good for the exact SN you provide to the CA. So if you request www.example.com
then it should only work for that domain name, it should not work for example.com
or anything besides www.example.com
.
However, many websites also work on alternate domain names. It is very common for the default domain name to work. So in the example www.example.com
; www
is a host name, and example.com
is a domain name. The certificate was requested for and issued to www.example.com
, and as established in the previous paragraph this does not match example.com
(because example.com
is requesting the default host (A) record for the domain example.com
; it should be very apparent that the host www
and the default host are not the same in a DNS sense, and certainly do not have to be the same website even).
Most people actually have the same website on both host names. Further most users expect that they can type either name in and the correct website will appear. Because of this most CAs do not issue the certificate you requested. They actually issue a certificate with the SN you provided (as above), and which also contains a Subject Alternate Name (SAN; which as the name implies provides alternate names that a user can type in and which should be accepted without a warning message). This most commonly only works when you request a 2rd level domain name (eg example.com
) and they very commonly ignore www
as a 3rd level domain name (eg www.example.com
becomes example.com
for the purposes of the certificate).
Commonly, when you request a certificate for example.com
or www.example.com
you actually get a certificate with a SN of example.com
and a SAN of www.example.com
. The TLD can usually be anything.
But, when you request a cert with a more specific name, such as your example (from the Question) where there are 4 levels (or more) of domain name, they do not include this alternate name.
You can specifically request one. Sometimes simply by asking them they'll issue it without additional charge. Other times you have to request a UCC or Multiple SAN certificate (same thing, different names). A wildcard cert would also work, though they tend to be more expensive and commonly require a higher degree of purchaser authentication.