I'm working on a web site with a several levels of subdomains. I need to secure all of them with SSL, and I'm trying to determine the correct certificate strategy.
Here's what I need to secure:
- Any combination of city.state.foo.com. (These are US states.)
My understanding is that a wildcard certificate can only cover one "level" of subdomain. According to RFC 2818:
Names may contain the wildcard character * which is considered to match any single domain name component or component fragment. E.g., *.a.com matches foo.a.com but not bar.foo.a.com. f*.com matches foo.com but not bar.com.
What I think I need is the following certificates:
*.foo.com, which will match, for example,
www.foo.com. (Though I'm not clear on whether
buffalo.ny.com, etc. I will eventually need 50 such certificates to match all the states, once our site expands to serve them all.
My questions are:
- Is this scheme correct? In the scenario above, if a user visits
ca.foo.com, will they get the certificate for
- How can I ensure that users see all of these subdomains as legitimately owned by us? For example, if a user visits
mountain-view.ca.foo.com, and those are different certificates, will they get a warning? Is there some way to assure their browser that these certificates share the same owner?