I'm in the process of buying an SSL cert, and I'm confused by this part: Many CAs say they'll add www. to your domain, so that e.g. if you buy a single-domain cert app.example.com, they'll also add www.app.example.com as a matching domain name in your cert.

A related example is that if you buy a wildcard cert, say *.example.com, some CAs also say that they'll give you a cert that covers example.com (I know that if your CN only has *.example.com, it will not match example.com).

In both cases, they only seem to ask me to specify one CN – app.example.com or *.example.com.

Which makes me wonder: How do they add the www. part (www.app.example.com for app.example.com) or the bare domain part (example.com for *.example.com) when they issue me the cert?

In addition, when we create a self-signed cert, can we also use the same technique? If so, is there any example using OpenSSL to do it? I already know how to create a self-signed cert and have your users trust your "in-house root CA cert", so I'm curious about what it takes to add additional CNs (or is it the subjectAltName field?) to your CSR or the eventually-issued cert.


The CA puts exactly what it wishes to put in the certificate it issues. The certificate request that you send poses no constraint whatsoever on the CA. The certificate request is just a vessel for your public key and, possibly, additional information that you might like to find in the resulting certificate, such as a specific server name. The CA is free, both technically and legally, to disregard or alter such information as it sees fit.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.