0

I have an internal domain that is (/ can be) suffixed. For instance:

server1.mynetwork.ken also resolves with server1

I have a self-signed wildcard certificate for mynetwork.ken. When I got to https://server1.mynetwork.ken the certificate is fine but when I go to https://server1 the browser complains about invalid common name (which makes sense).

What's the easiest way to get around this?

Should I create a global wildcard * . * ?

2

What's the easiest way to get around this?

The certificates subject must match the domain name you use. You might try with including just server1 in the certificate but the best way is to actually use the full name to access the site.

Should I create a global wildcard * . * ?

Only the leftmost label can include a wildcard. This means *.* will not work.

2

Should I create a global wildcard * . * ?

I don't think any application will let you do this.

You can achieve this by having an A record of www.server1.mynetwork.ken and then a CNAME record of server1 to www.server1.mynetwork.ken.

0

The easiest way around this is to

Configure your web server to forward http[s]://server1 to https://server1.mynetwork.ken

This means that people (you) type server1\ in your browser address bar and you automatically arrive at the https version of the full site.

If this is not possible then you would build a certificate specifying, well, anything for the common name, and then use the extension field "alternate names" which is an array, to add as many aliases as you want. Typically:

localhost, *.mynetwork.ken, mynetwork.ken

If someone goes directly to https://server1 then there is nothing you can do short of getting an explicit certificate for server1. The easiest way is to rely on http to catch the 'convenience' url case, and forward to a fully qualified https.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.