2

We have a wildcard certificate that works for several cloudfront hosts we use at work here (all or mostly all tied to an S3 bucket) but when accessing using SSL, my browser yields an NET::ERR_CERT_COMMON_NAME_INVALID.

Heres the full message:

Your connection is not private

Attackers might be trying to steal your information from api.assets.portablenorthpole.com (for example, passwords, messages or credit cards). NET::ERR_CERT_COMMON_NAME_INVALID

This server could not prove that it is api.assets.portablenorthpole.com; its security certificate is from *.portablenorthpole.com. This may be caused by a misconfiguration or an attacker intercepting your connection.

Strangely, the configuration is the same for "https://assets.portablenorthpole.com/" and that one works with the same SSL. Both use SNI and feature similar configuration but one fails to respond correctly.

Can you give me a hint what to search for?

  • Could it be because i'm using a double sub-domain? I realize that all my other cloudfronts have only 1 subdomain level! – Mathieu Dumoulin Aug 5 '15 at 19:14
  • 1
    Yes, a wild-card is only valid for one level, so *.example.com works, *.*.example.com does not. – HBruijn Aug 5 '15 at 19:24
  • @HBruijn Thanks, please issue an answer and i'll approve it, i'm sure it's the right one although i can't test it right away – Mathieu Dumoulin Aug 5 '15 at 19:26
  • Although I'm quite sure that it is the case I can't remember why so it would be a pretty awful answer :) – HBruijn Aug 5 '15 at 19:38
  • I confirm the problem is fixed – Mathieu Dumoulin Aug 5 '15 at 19:47
5

The * in a wildcard cert is only properly allowed to match a single element at the far left side in the hostname.

If the wildcard character is the only character of the left-most label in the presented identifier, the client SHOULD NOT compare against anything but the left-most label of the reference identifier (e.g., *.example.com would match foo.example.com but not bar.foo.example.com or example.com).

https://tools.ietf.org/html/rfc6125#section-6.4.3

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.