Can the common name for a wild-carded SSL certificate be more specific than simply "*"?

e.g.: in the case of a firewall with multiple interfaces and similar names assigned to those interfaces: pix-lan1, pix-lan2, pix-wan1, etc. Is it OK to use a CN of pix-*.domain for a single certificate?

Clearly *.domain would work; but we've found that using a single wild-carded certificate enterprise wide requires the simultaneous replacement of certificates on far too many machines.

  • Pretty sure you can't, but you can have more than one certificate for the same CN. – heavyd Feb 18 '16 at 17:14

This depends on the protocol. For HTTPS RFC 2818 explicitly allows the wildcard character to be inside the label, i.e. something like f*.example.com. And I cannot find any statements in the baseline requirements of the CA browser forum that restrict the wildcard to the full label only.

For other protocols like LDAP or SMTP the situation if different. Most allow only in the standard only full-label wildcards like *.example.com and don't allow f*.example.com. But I'm not sure how much these differences are really enforced in practice because often there is shared code for the validation of the subject.

  • I've discovered that the signatory we use is not happy with anything other than a solitary *. So SubjectAltName is working fine. – ericx Feb 18 '16 at 21:34

RFC 6125 paragraph 6.4.3 says:

  1. The client MAY match a presented identifier in which the wildcard character is not the only character of the label (e.g., baz*.example.net and baz.example.net and bz.example.net would be taken to match baz1.example.net and foobaz.example.net and buzz.example.net, respectively).

However, paragraph 7.2 of the same document raises security concerns. Appendix B lists some applications and their use of wildcards. For example, wildcard such as your example works in HTTP but not in LDAP or SMTP/POP3/IMAP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.