26

Shouldn't this be a trusted certificate considering it's a wildcard SSL certificate?

That is, shouldn't *.delaware.gov cover www.corp.delaware.gov?

Wildcard SSL certificate

Improve this question
2
  • 1
    See also this blog post by SE employee Nick Craver, which touches on some related issues involving the implementation of SSL certificates for the SE network.
    – user1535629
    Mar 2, 2014 at 9:32
  • MSIE does not trust it either
    – kinokijuf
    Apr 13, 2014 at 10:15

1 Answer 1

Reset to default
46

The wildcard replaces only one part of the hostname, e.g. *.delaware.gov covers www.delaware.gov or corp.delaware.gov but not www.corp.delavware.gov. From RFC2818, section 3.1:

...Names may contain the wildcard character * which is considered to match any single domain name component or component fragment. E.g., *.a.com matches foo.a.com but not bar.foo.a.com. f*.com matches foo.com but not bar.com.

Improve this answer
6
  • 2
    @ack__: Related info at security.stackexchange.com/questions/37887/…
    – Mechanical snail
    Feb 28, 2014 at 22:52
  • 9
    There is no complete wildcard SSL. The solution in this case would have been to have a certificate with subject alternative names for at least *.delaware.gov (exists), delaware.gov (exists) and *.corp.delaware.gov (missing). Something like *.*.delaware.gov is not allowed.
    – Steffen Ullrich
    Feb 28, 2014 at 23:05
  • 1
    RFC6125 tries to unify the different handling of certificates among HTTP, LDAP, SMTP etc, but it does not allow *.*.example.com or similar. In section 6.4.3 it clearly states that wildcards should only be used within the left-most label (item 1) and that a * should only be compared against the left-most label of the reference identifier (item 2). It explicitely forbids *.example.com to match bar.foo.example.com. Section 7.2 only acknowledges that not all previous specifications explicitly forbid something like *.*.example.com, but neither this RFC nor RFC2818 (HTTPS) allow it.
    – Steffen Ullrich
    Mar 1, 2014 at 5:13
  • 1
    @SteffenUllrich - "... it does not allow *.*.example.com or similar." - Is there any rationale for why this restriction was put in place ? And, does that rationale still apply today ? I don't see any downside in allowing this, other than the lost revenue for SSL Certificate issuers.
    – Kevin Fegan
    Mar 5, 2014 at 8:28
  • 1
    I don't know the real motivation, but I guess it is to let an organization better reflect it structure and control. You often have a main organisation (like university) with a website and then sub-organisations (like department) which manage their own infrastructure. In this case it would be bad if a compromise of the *.university certificate would make it possible to overwrite all *.department.university certificates.
    – Steffen Ullrich
    Mar 5, 2014 at 16:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .