1

I have few questions regarding Wildcard vs SAN certificates.

Let’s say I’ve got a wildcard certificate for *.example.com, so the Wildcard certificate will cover all one level subdomains e.g. owa.example.com, contact.example.com etc. but it will not cover domains like test.owa.example.com.

It will not cover the main domain example.com, correct? But if one goes to my site via www.example.com, it will work without any certificate warning, correct?

Wikipedia says:

The "naked" domain is valid when added separately as a Subject Alternative Name (SubjectAltName):[5] • example.com >

So how to call then this type of certificate? Wildcard SAN certificate? Does that mean that a Wildcard certificate can be a SAN certificate at the same time?

Also, if a wildcard certificate applies to a given domain, example.com in this case, can I include different domains e.g. example.com, test.com, adam.com in a SAN certificate?

3

if one goes to my site via www.example.com , it will work without any certificate warning , correct?

Yes.

how to call then this type of certificate ? Wildcard SAN certificate?

Whatever marketing department comes up with.

There is no fixed term "SAN certificate" -- it is a shorthand, possessive expression: a certificate with the SAN extension defined.

if a wildcard certificate applies to a given domain, example.com in this case, can I include different domains e.g. example.com, test.com, adam.com in a SAN [ ]

Yes, you can.

  • Thank you. So, in a Wildcard certificate the Issued to filed would be set to *.example.com. If I add test.com in Sub Alter Name Filed, will it then match everything , e.g. owa.test.com or only test.com ? – cyzczy Mar 29 '17 at 8:45
  • 1
    Only test.com. – techraf Mar 29 '17 at 8:46
  • And if I would include *.test.com in the SAN filed, that would behave basically the same way as the Wildcard for the example .com domain, correct ? – cyzczy Mar 29 '17 at 8:48
  • 1
    Yes, it would. Of course, provided the browser would support it, but most likely do. – techraf Mar 29 '17 at 8:53
  • One last question. Let's say, I try to access server1.prod.test.com but the certificate presented by the server contains *lab.thisistest.com in the Issued to filed, and exact the same value in the SAN filed, the browser will provide me with a warning ? Also, if the Issued to and SAN filed reflect the same value, this doesn't make much sense, correct? I would have to add *test.com in to the SAN filed or prod.test.com, correct ? If yes, I guess that this would required then a new certificate to be issued? – cyzczy Mar 29 '17 at 9:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.