SSL wildcard certificate + SAN to match multiple specific subdomains of wildcard section

Question

Say I own the domain example.com and want to setup multiple websites as sub domains on this domain, but these websites also use several special endpoints as further subdomains. Can I put them all on 1 SAN + wildcard SSL certificate, and what providers might support creation of said certificate?

I.e., I would like to protect

example.com
siteXXX.example.com (where siteXXX refers to the sub sites token)
www.example.com
api.example.com
mail.example.com
www.siteXXX.example.com
api.siteXXX.example.com
mail.siteXXX.example.com

I was thinking I'd need something that looks like

example.com
*.example.com (covers siteXXX, api, www, mail)
www.*.example.com (covers www.siteXXX)
api.*.example.com (covers api.siteXXX)
mail.*.example.com (covers mail.siteXXX)

Does the standard even allow this? I'm not sure because I can only find example with the wildcard component as the lowest level sub domain, not a mid level sub domain.

Nope, can't do that. Why not generate each site with it's own San? — Jacob Evans, Oct 14 '17 at 06:32
Mostly dupe https://serverfault.com/q/296390/ and https://serverfault.com/q/817255/ and https://serverfault.com/q/871171/ — dave_thompson_085, Oct 15 '17 at 05:18
@dave_thompson_085 No it's, not, all those questions, applied to why wildcard subdomains only matched one level, I was asking if I could have the wildcard component as a non left most segment of the domain name. Zip's answer explains the reason why this wron't work. — Glen Fletcher, Oct 15 '17 at 10:34

score 1 · Accepted Answer · edited Oct 07 '21 at 07:59

Even if you issue a certificate with those SANs, they would not validate those domains on browsers or any application that follows the best practices for a PKI (read this RFC from the IETF, for example).

You are thinking as a legitimate owner of all the domains covered by that certificate, but what if a browser accepted a certificate for www.*.com?

I own www.zip.com, but that shouldn't make me able to issue a certificate that would validate www.amazon.com too.

score 0 · Answer 2 · answered Oct 15 '17 at 01:42

A Wildcard SSL certificate covers only the subdomains on the name it's registered to. A *.domain.com SSL certificate will cover anything under domain.com, but not under the subdomains in domain.com. So, it wouldn't cover second.first.domain.com.

Although Wildcard Certificates do not cover multiple levels of subdomains, you can add it to the certificate as a SAN. To do this, check with your certificate issuer on how to do this. Most will allow for this. You simply add the subdomain with another asterisk in it. So, I can add a SAN of *.first.domain.com to the certificate and that will cover my second.first.domain.com domain. It also covers anything under it. And be sure to add the root domain itself, since the Wildcard Certificate does not cover it (I think).

So, in response to your question, you can obtain a Wildcard Certificate securing

*.domainname.com

With SANs of

domainname.com
*.siteXXX.domainname.com

I hope this helps!

SSL wildcard certificate + SAN to match multiple specific subdomains of wildcard section

2 Answers2