1

While configuring SSL and certificates in my Apache server I had some troubles with second-level-domains like .com.pt.

If I ask for a certificate for a www.xpto.com domain it will be issued for www.xpto.com and xpto.com.

If i ask for a certificate for www.xpto.com.pt it will only work for www.xpto.com.pt but not for xpto.com.pt (issued by RapidSSL)

Is there a technical reason for that?

1 Answer 1

4

Yes. For the uninitiated lets break this down into little pieces:

When you request a standard x509 Certificate with Server Authentication Extension (commonly called an SSL Cert) you must provide a Subject Name (SN). This SN must match what the user types in for the certificate to be used without a warning message.

Technically the certificate should only be good for the exact SN you provide to the CA. So if you request www.example.com then it should only work for that domain name, it should not work for example.com or anything besides www.example.com.

However, many websites also work on alternate domain names. It is very common for the default domain name to work. So in the example www.example.com; www is a host name, and example.com is a domain name. The certificate was requested for and issued to www.example.com, and as established in the previous paragraph this does not match example.com (because example.com is requesting the default host (A) record for the domain example.com; it should be very apparent that the host www and the default host are not the same in a DNS sense, and certainly do not have to be the same website even).

Most people actually have the same website on both host names. Further most users expect that they can type either name in and the correct website will appear. Because of this most CAs do not issue the certificate you requested. They actually issue a certificate with the SN you provided (as above), and which also contains a Subject Alternate Name (SAN; which as the name implies provides alternate names that a user can type in and which should be accepted without a warning message). This most commonly only works when you request a 2rd level domain name (eg example.com) and they very commonly ignore www as a 3rd level domain name (eg www.example.com becomes example.com for the purposes of the certificate).

Commonly, when you request a certificate for example.com or www.example.com you actually get a certificate with a SN of example.com and a SAN of www.example.com. The TLD can usually be anything.

But, when you request a cert with a more specific name, such as your example (from the Question) where there are 4 levels (or more) of domain name, they do not include this alternate name.

You can specifically request one. Sometimes simply by asking them they'll issue it without additional charge. Other times you have to request a UCC or Multiple SAN certificate (same thing, different names). A wildcard cert would also work, though they tend to be more expensive and commonly require a higher degree of purchaser authentication.

3
  • that's inconsistent with the example above where when you request for a .com domain it will work both for www and without www. Oct 20, 2011 at 14:16
  • @GriffinHeart That has nothing to do with whether it's a .com or not, and everything to do with the alternate name attribute that the certificate authority adds to the certificate, as Chris said - the fact that it has more levels to the name is likely altering the certificate authority's default behavior. Oct 20, 2011 at 14:22
  • @GriffinHeart Please see the revised answer, which hopefully is more clear.
    – Chris S
    Oct 20, 2011 at 14:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .