0

I am attempting to create a wildcard SSL cert with a Subject Alternative Name (SAN) for use in IIS 7.5 and I'm having some issues. Because I need to include a SAN, I am using the Custom Certificate Request tool under the Certificates snap-in on Windows.

Thus far, I have managed to get a working wildcard certificate when I use the IIS 7.5 Create Certificate Request wizard, and a working SAN certificate when I use the Custom Certificate Request wizard (in the Certificates snap-in), but I have been unable to get both working in the same cert.

The cert which I generated with the Custom Certificate Request wizard has the following properties:

Subject Name:

  • CN=*.domain.local

Alternative Name:

  • DNS=domain.local

Extended Key Usage:

  • Server Authentication

(Private) Key Type:

  • Exchange

(Private) Key Options:

  • Key size: 2048
  • [x] Make private key exportable

With the above cert in IIS 7.5, requests to the SAN of https://domain.local are secure, but https://*.domain.local requests are unsecure with the browser stating that the cert is only valid for domain.local (instead of *.domain.local).

Ultimately, my objective is to have a cert which works on *.domain.local and domain.local.

Using the Custom Certificate Request wizard in the Windows Certificates snap-in, how can I create a certificate request for a cert containing a wildcard and a SAN attribute?

Nathan Taylor
  • 240
  • 3
  • 11
  • What do the subject and subject alternate name attributes on the certificate look like? – Shane Madden Feb 02 '12 at 04:50
  • @ShaneMadden They are exactly as defined in the request. – Nathan Taylor Feb 02 '12 at 05:21
  • 1
    This is exactly how it is supposed to work. Perhaps you should post your request and certificate files in PEM format for further examination – the-wabbit Feb 02 '12 at 07:04
  • @syneticon-dj Do you happen to know how i can export my request as PEM? The only option I'm given with the request wizard is Base64 or Binary output. – Nathan Taylor Feb 02 '12 at 18:47
  • 1
    PEM is Base64 encoded as well, but you are right, you do not get it as an export choice. I was just aiming at the fact that it should be ASCII-only so it could be published easily, so feel free to export in any Base64-encoded format and pasting into your question. Make sure **not** to export the private key :) – the-wabbit Feb 03 '12 at 07:53

1 Answers1

2

When a subject alternative name is in place, the common name (edit: from the subject) is no longer used. Solution: Add the wildcard name to the list of subject alternative names.

unixtippse
  • 880
  • 1
  • 6
  • 13