Shouldn't this be a trusted certificate considering it's a wildcard SSL certificate?
That is, shouldn't *.delaware.gov
cover www.corp.delaware.gov?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this communityShouldn't this be a trusted certificate considering it's a wildcard SSL certificate?
That is, shouldn't *.delaware.gov
cover www.corp.delaware.gov?
The wildcard replaces only one part of the hostname, e.g. *.delaware.gov covers www.delaware.gov or corp.delaware.gov but not www.corp.delavware.gov. From RFC2818, section 3.1:
...Names may contain the wildcard character
*
which is considered to match any single domain name component or component fragment. E.g.,*.a.com
matchesfoo.a.com
but notbar.foo.a.com
.f*.com
matchesfoo.com
but notbar.com
.
*.delaware.gov
(exists), delaware.gov (exists) and *.corp.delaware.gov
(missing). Something like *.*.delaware.gov
is not allowed.
Feb 28, 2014 at 23:05
*.*.example.com
or similar. In section 6.4.3 it clearly states that wildcards should only be used within the left-most label (item 1) and that a *
should only be compared against the left-most label of the reference identifier (item 2). It explicitely forbids *.example.com
to match bar.foo.example.com
. Section 7.2 only acknowledges that not all previous specifications explicitly forbid something like *.*.example.com
, but neither this RFC nor RFC2818 (HTTPS) allow it.
Mar 1, 2014 at 5:13
"... it does not allow *.*.example.com or similar."
- Is there any rationale for why this restriction was put in place ? And, does that rationale still apply today ? I don't see any downside in allowing this, other than the lost revenue for SSL Certificate issuers.
Mar 5, 2014 at 8:28