I have a webserver in my intranet which can be accessed via subdomain.domain.com and simply subdomain. The SSL certificate is created for subdomain.domain.com which results in a warning as soon as I access just subdomain via https.

Any idea how this can be solved? (yes, I don't know much about ssl server configuration :-)

  • 1
    How are you signing the certificates? – cjc Nov 2 '12 at 10:05
  • selfsigned - don't ask about the details... – rdmueller Nov 2 '12 at 10:08
  • 3
    Look for Server Name Indication (SNI) or Subject Alternate Name (SAN) capability in your signing or request generation. You should be able to just submit subdomain as an alternative. Note that there might be some browser incompatibility with those methods, particularly with older browsers. – cjc Nov 2 '12 at 10:16
  • hm. It seems sthat there is a problem with SNI and IE on XP... – rdmueller Nov 2 '12 at 12:42
  • 2
    Yes. IE on XP would be an issue. Hmm. It's an intranet. Do you control IP allocation? If so, and you're supporting browsers that don't play well with SNI, you might just set up a second IP address on that machine, and deal with it the old fashioned way: one cert per IP address. The subdomain virtual host can just do a redirect to subdomain.domain.com. If you can do SAN, you might have broader compatibility: digicert.com/subject-alternative-name-compatibility.htm – cjc Nov 2 '12 at 13:43

You can simply add the alternate names to the certificate when signing. For example, if you use OpenSSL and you use the server_ca section when signing (e.g. openssl ca -config my.conf -name server_ca -in server.req -out server.crt) , make sure you have a section similar to the following in the config file you use when signing:

x509_extensions = server_cert

subjectAltName = @server_alt_names

DNS.1 = subdomain.domain.com
DNS.2 = subdomain

To verify your certificate, pipe it to openssl x509 -noout -text. You should see a line like this in the output:

        X509v3 Subject Alternative Name: 
            DNS:subdomain.domain.com, DNS:subdomain

I saw the comment about SNI but if you just sign the certificate SNI will not matter at all (as long as both names are supposed to point to the same content). This method works for sure for Firefox and IE, not at all for Chrome and wget. In fact, the CN in the certificate does not even matter if you have the names listed as alternate names.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.