1

I have two SSL certificate one for *.sub.domain.com and one for *.domain.com.

I don't have issues with domain level wildcard certificate. Meaning https://www.domain.com & https://domain.com works fine with out any certificate errors.

But for the other one https://sub.domain.com gives certificate error(address miss match ) and https://www.sub.domain.com doesn't give any error.

Just another info both certificate are from the same provider.

Improve this question
10
  • Which SSL certificate are you offering up on the server sub.domain.com ? Commented Feb 3, 2015 at 11:34
  • Its *.sub.domain.com Commented Feb 3, 2015 at 11:38
  • 4
    That's your problem - wrong certificate. sub.domain.com doesn't match *.sub.domain.com, but it does match *.domain.com. Commented Feb 3, 2015 at 11:47
  • thanks @MadHatter. But wildcard certificates will match up to one level from the left. I think as zakjan mentioned its probably SAN difference between two certificate. Commented Feb 3, 2015 at 11:54
  • Yes, but they won't match nothing at all. Zakjan's point is that domain.com doesn't match *.domain.com, which is very true, and just as truly sub.domain.com doesn't match *.sub.domain.com. It is true that in the bare domain case this is often handled by SANs, but in your case you have a wildcard certificate that will match sub.domain.com - all you need to do is use it. Commented Feb 3, 2015 at 12:01

1 Answer 1

Reset to default
3

Wildcard certificate issued for *.domain.com doesn't secure bare domain.com by default.

Run openssl x509 -in certificate.crt -noout -text on both certs to see their human-readable content. Look for X509v3 Subject Alternative Name (SAN) field. If it is present, it specifies multiple DNS names, which can be secured by the cert.

I suppose your *.domain.com cert has it, whereas *.sub.domain.com doesn't, in that case ask for a new wildcard SAN cert.

Improve this answer
2
  • Just checked that *.domain.com has domain.com as well but the subdomain certificate just have wildcard. Commented Feb 3, 2015 at 11:55
  • 2
    Instead of paying for a new cert, you can use *.domain.com to secure sub.domain.com as mentioned by @MadHatter, of course. Commented Feb 3, 2015 at 11:59

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.