We are using an internal Certificate Authority for our company. We noticed that it is possible to add as subjectAltName the hostname without the domain. We are using example.org for internal servers and example.com for external, public facing servers.

E.g. instead of using mysite.example.org, we can create a certificate like:

Subject: CN=mysite.example.org

In this way people can use https://mysite/ and it will work. The DNS search is example.org and example.com.

I have 3 questions:

  • is it secure?
  • what are the security problems that could be cause by such setup?
  • what is the type of attack that someone could take advantage of this config.

Edit1: It seems that public certificate authorities are moving away from signing certificates using an "internal name": https://cabforum.org/internal-names/ and https://www.digicert.com/internal-names.htm

1 Answer 1


is it secure?

a bit less than FQDN. The problem with short names is name ambiguity. FQDN is unique in public, but not necessary to be in private networks. The problem with short names is name ambiguity and nothing else. It is acceptable to use short names in small private networks, however it is impossible to maintain them in large networks. There is nothing wrong if you use unique short name in private networks. However, there might be an issue when multiple factory-provisioned devices are configured to share the same short name.

what is the type of attack that someone could take advantage of this config.

an attacker still have to spoof name resolution mechanism (DNS for FQDN and NetBIOS for short names) to redirect client to rogue host with the same name.

  • 1
    But the purpose of the server certificate shouldn't be to identify in an unambiguous way the server? Using short name, isn't it like having a corporate badge writing "John Doe" with no other distinctive features? Dec 15, 2016 at 14:00
  • 1
    The more ambiguites you have, the more chances that the user will connect to improper server. In Internet, each host must be unique within Internet. FQDN solves the problem, while short names raise ambiguity (this is the reason why public CAs do not issue certificates to short names).
    – Crypt32
    Dec 15, 2016 at 20:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .