I am attempting to create a wildcard SSL cert with a Subject Alternative Name (SAN) for use in IIS 7.5 and I'm having some issues. Because I need to include a SAN, I am using the Custom Certificate Request tool under the Certificates snap-in on Windows.

Thus far, I have managed to get a working wildcard certificate when I use the IIS 7.5 Create Certificate Request wizard, and a working SAN certificate when I use the Custom Certificate Request wizard (in the Certificates snap-in), but I have been unable to get both working in the same cert.

The cert which I generated with the Custom Certificate Request wizard has the following properties:

Subject Name:

  • CN=*.domain.local

Alternative Name:

  • DNS=domain.local

Extended Key Usage:

  • Server Authentication

(Private) Key Type:

  • Exchange

(Private) Key Options:

  • Key size: 2048
  • [x] Make private key exportable

With the above cert in IIS 7.5, requests to the SAN of https://domain.local are secure, but https://*.domain.local requests are unsecure with the browser stating that the cert is only valid for domain.local (instead of *.domain.local).

Ultimately, my objective is to have a cert which works on *.domain.local and domain.local.

Using the Custom Certificate Request wizard in the Windows Certificates snap-in, how can I create a certificate request for a cert containing a wildcard and a SAN attribute?

  • What do the subject and subject alternate name attributes on the certificate look like? – Shane Madden Feb 2 '12 at 4:50
  • @ShaneMadden They are exactly as defined in the request. – Nathan Taylor Feb 2 '12 at 5:21
  • 1
    This is exactly how it is supposed to work. Perhaps you should post your request and certificate files in PEM format for further examination – the-wabbit Feb 2 '12 at 7:04
  • @syneticon-dj Do you happen to know how i can export my request as PEM? The only option I'm given with the request wizard is Base64 or Binary output. – Nathan Taylor Feb 2 '12 at 18:47
  • 1
    PEM is Base64 encoded as well, but you are right, you do not get it as an export choice. I was just aiming at the fact that it should be ASCII-only so it could be published easily, so feel free to export in any Base64-encoded format and pasting into your question. Make sure not to export the private key :) – the-wabbit Feb 3 '12 at 7:53

When a subject alternative name is in place, the common name (edit: from the subject) is no longer used. Solution: Add the wildcard name to the list of subject alternative names.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.