Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have created my own Certificate Authority and installed the certificate on a few computers.

Now I have generated a server certificate with common name *.mydomain.com and Subject Alternative Name (SAN) DNS mydomain.com to match all first level subdomains and the root domain. I signed the server certificate with the CA.

The browsers Firefox and Safari accept the SAN mydomain.com but fail verifying the wildcard domain *.mydomain.com. Error message:

Certificate belongs to a different site...

Can I not combine wildcard and SAN or do I have to put the wildcard in the SAN? Or both in the SAN?

share|improve this question

1 Answer 1

up vote 4 down vote accepted

It is not a matter of wildcards. The behaviour you observe is due to the following: if there is a Subject Alt Name extension in the certificate, then the Common Name part of the DN is simply ignored. Said otherwise, the server names in the certificate should always be in a Subject Alt Name extension; the Common Name part of the subject DN is used as a fallback only if the Subject Alt Name extension is altogether missing (precisely, if there is no SAN, or if there is a SAN which contains no dNSName element at all). See RFC 2818, section 3.1:

If a subjectAltName extension of type dNSName is present, that MUST
be used as the identity. Otherwise, the (most specific) Common Name
field in the Subject field of the certificate MUST be used. Although
the use of the Common Name is existing practice, it is deprecated and
Certification Authorities are encouraged to use the dNSName instead.

Therefore, in your case, you should put both mydomain.com and *.mydomain.com as dNSName elements in the SAN extension (the SAN extension can contain many DNS names). Whether names are wildcard or not does not matter at this level. As an illustration, have a look at the certificate used by Google (connect on https://www.google.com, then ask your browser to display the "certificate details"): this certificate currently features a SAN extension with no less than 44 DNS names, 34 of which being wildcard names.

share|improve this answer
    
Thank you, very pro answer and it worked like you said! –  Toxiro Dec 19 '13 at 15:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.