1

I have two SSL certificate one for *.sub.domain.com and one for *.domain.com.

I don't have issues with domain level wildcard certificate. Meaning https://www.domain.com & https://domain.com works fine with out any certificate errors.

But for the other one https://sub.domain.com gives certificate error(address miss match ) and https://www.sub.domain.com doesn't give any error.

Just another info both certificate are from the same provider.

|improve this question
  • Which SSL certificate are you offering up on the server sub.domain.com ? – MadHatter Feb 3 '15 at 11:34
  • Its *.sub.domain.com – NMK Feb 3 '15 at 11:38
  • 4
    That's your problem - wrong certificate. sub.domain.com doesn't match *.sub.domain.com, but it does match *.domain.com. – MadHatter Feb 3 '15 at 11:47
  • thanks @MadHatter. But wildcard certificates will match up to one level from the left. I think as zakjan mentioned its probably SAN difference between two certificate. – NMK Feb 3 '15 at 11:54
  • Yes, but they won't match nothing at all. Zakjan's point is that domain.com doesn't match *.domain.com, which is very true, and just as truly sub.domain.com doesn't match *.sub.domain.com. It is true that in the bare domain case this is often handled by SANs, but in your case you have a wildcard certificate that will match sub.domain.com - all you need to do is use it. – MadHatter Feb 3 '15 at 12:01
3

Wildcard certificate issued for *.domain.com doesn't secure bare domain.com by default.

Run openssl x509 -in certificate.crt -noout -text on both certs to see their human-readable content. Look for X509v3 Subject Alternative Name (SAN) field. If it is present, it specifies multiple DNS names, which can be secured by the cert.

I suppose your *.domain.com cert has it, whereas *.sub.domain.com doesn't, in that case ask for a new wildcard SAN cert.

|improve this answer
  • Just checked that *.domain.com has domain.com as well but the subdomain certificate just have wildcard. – NMK Feb 3 '15 at 11:55
  • 2
    Instead of paying for a new cert, you can use *.domain.com to secure sub.domain.com as mentioned by @MadHatter, of course. – zakjan Feb 3 '15 at 11:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.