5

Consider following example:

We created own CA certificate (self-signed) and imported into browser trust store. We signed certificate by this CA certificate with SAN extension with following domains:

  • DNS: *.dev
  • DNS: *.*.dev

No matter if CN is present in certificate or even whole DN is missing. Still getting following errors in browsers when accessing domain https://test.dev:

Firefox 45.8.0:

test.dev uses an invalid security certificate. The certificate is only valid for the following names: *.dev, *.*.dev Error code: SSL_ERROR_BAD_CERT_DOMAIN

Chrome 58.0.3029.81 (64-bit):

NET::ERR_CERT_COMMON_NAME_INVALID

There is only one working wildcard in SAN for third level domain, when browsers accepts connection:

  • DNS: *.secondlevel.dev

Multilevel wildcard in SAN is not accepted by browsers:

  • DNS: *.*.secondlevel.dev

Is there a way to have multilevel wildcard in SAN extension or what are limitations for wildcards in SAN extensions?

8

From RFC 6125:

The client SHOULD NOT attempt to match a presented identifier in which the wildcard character comprises a label other than the left-most label (e.g., do not match bar.*.example.net).

Thus, wildcard is only allowed in the left-most label which automatically restricts it to at most one level of wildcard.

A similar restriction can also be found in the CA/Browser Forum Baseline Requirements 1.4.2 which combined with other definitions in the document restricts the wildcard to only the left-most label:

Wildcard Certificate:
A Certificate containing an asterisk (*) in the left‐most position of any of the Subject Fully‐Qualified Domain Names contained in the Certificate.

Apart from that the CA/Browser Forum Baseline Requirements have more restrictions which result in *.dev not working since dev is in the public suffix list:

CAs SHALL revoke any certificate where wildcard character occurs in the first label position immediately to the left of a “registry‐controlled” label or “public suffix”.

For more information see section "3.2.2.6 Wildcard Domain Validation" of the Baseline Requirements.

  • 1
    However it means *.dev should work as expected. – ZZromanZZ Apr 28 '17 at 7:46
  • @ZZromanZZ: see update which explains why *.dev is not working. – Steffen Ullrich Apr 28 '17 at 8:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.