Shouldn't this be a trusted certificate considering it's a wildcard SSL certificate?

That is, shouldn't *.delaware.gov cover www.corp.delaware.gov?

Wildcard SSL certificate

  • 1
    See also this blog post by SE employee Nick Craver, which touches on some related issues involving the implementation of SSL certificates for the SE network. Mar 2, 2014 at 9:32
  • MSIE does not trust it either
    – kinokijuf
    Apr 13, 2014 at 10:15

1 Answer 1


The wildcard replaces only one part of the hostname, e.g. *.delaware.gov covers www.delaware.gov or corp.delaware.gov but not www.corp.delavware.gov. From RFC2818, section 3.1:

...Names may contain the wildcard character * which is considered to match any single domain name component or component fragment. E.g., *.a.com matches foo.a.com but not bar.foo.a.com. f*.com matches foo.com but not bar.com.

  • 2
    @ack__: Related info at security.stackexchange.com/questions/37887/… Feb 28, 2014 at 22:52
  • 9
    There is no complete wildcard SSL. The solution in this case would have been to have a certificate with subject alternative names for at least *.delaware.gov (exists), delaware.gov (exists) and *.corp.delaware.gov (missing). Something like *.*.delaware.gov is not allowed. Feb 28, 2014 at 23:05
  • 1
    RFC6125 tries to unify the different handling of certificates among HTTP, LDAP, SMTP etc, but it does not allow *.*.example.com or similar. In section 6.4.3 it clearly states that wildcards should only be used within the left-most label (item 1) and that a * should only be compared against the left-most label of the reference identifier (item 2). It explicitely forbids *.example.com to match bar.foo.example.com. Section 7.2 only acknowledges that not all previous specifications explicitly forbid something like *.*.example.com, but neither this RFC nor RFC2818 (HTTPS) allow it. Mar 1, 2014 at 5:13
  • 1
    @SteffenUllrich - "... it does not allow *.*.example.com or similar." - Is there any rationale for why this restriction was put in place ? And, does that rationale still apply today ? I don't see any downside in allowing this, other than the lost revenue for SSL Certificate issuers. Mar 5, 2014 at 8:28
  • 1
    I don't know the real motivation, but I guess it is to let an organization better reflect it structure and control. You often have a main organisation (like university) with a website and then sub-organisations (like department) which manage their own infrastructure. In this case it would be bad if a compromise of the *.university certificate would make it possible to overwrite all *.department.university certificates. Mar 5, 2014 at 16:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.