Is it possible to make SAN wildcard self-signed certificate for whole local TLD (.test)?

[ san ]
subjectAltName                  = @alt_names

[ alt_names ]
DNS.1                           = localhost
DNS.2                           = *.test

Then i've added this certificate to a Keychain (MacOS), but browser complains, when i try to visit: domain.test, it says that certificate belongs to a localhost, but not to a domain.test

1 Answer 1


Yes, this is technically valid according to RFC 6125.

However, many web browsers have decided to reject wildcards on the TLD for security reasons.

See: Can a wildcard SSL certificate be issued for a second level domain? | Information Security Stack Exchange

  • So there's no workaround? Can i force Chrome to accept it? Mar 19, 2018 at 8:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .