2

Say I own the domain, domainname.com, and what to setup multiple websites as sub domains on this domain, but these websites also use several special endpoints as further subdomains, can I put them all on 1 SAN + wildcard SSL certificate, and what providers might support creation of said certificate

i.e. I what to protect:

domainname.com
siteXXX.domainname.com (where siteXXX refers to the sub sites token)
www.domainname.com
api.domainname.com
mail.domainname.com
www.siteXXX.domainname.com
api.siteXXX.domainname.com
mail.siteXXX.domainname.com

so I was thinking I need something that looks like

domainname.com
*.domainname.com (covers siteXXX, api, www, mail)
www.*.domainname.com (covers www.siteXXX)
api.*.domainname.com (covers api.siteXXX)
mail.*.domainname.com (covers mail.siteXXX)

dose the standard even allow this, I'm not sure because I can only find example with the wildcard component as the lowest level sub domain, not a mid level sub domain.

1

Even if you issue a certificate with those SANs, they would not validate those domains on browsers or any application that follows the best practices for a PKI (read this RFC from the IETF, for example).

You are thinking as a legitimate owner of all the domains covered by that certificate, but what if a browser accepted a certificate for www.*.com?

I own www.zip.com, but that shouldn't make me able to issue a certificate that would validate www.amazon.com too.

0

A Wildcard SSL certificate covers only the subdomains on the name it's registered to. A *.domain.com SSL certificate will cover anything under domain.com, but not under the subdomains in domain.com. So, it wouldn't cover second.first.domain.com.

Although Wildcard Certificates do not cover multiple levels of subdomains, you can add it to the certificate as a SAN. To do this, check with your certificate issuer on how to do this. Most will allow for this. You simply add the subdomain with another asterisk in it. So, I can add a SAN of *.first.domain.com to the certificate and that will cover my second.first.domain.com domain. It also covers anything under it. And be sure to add the root domain itself, since the Wildcard Certificate does not cover it (I think).

So, in response to your question, you can obtain a Wildcard Certificate securing

*.domainname.com

With SANs of

domainname.com
*.siteXXX.domainname.com

I hope this helps!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.