4

I have a domain like this: https://abc-.domain.com/. If I open this site different browser are showing me different results. E.g. Firefox throws the error security risk. Chrome on the other side loads the site without issues.

If I call the domain https://abc.domain.com the site is opened in Firefox without issues. So the only difference I can see is the hypen -.

The certificate should be valid for the following subdomains/domains:

*.domain.com, domain.com

I tried to verfiy the certificate with openssl s_client -debug -connect abc-.domain.com:443 and can't find something wrong.

So is the hyphen not a valid wildcard character?

3
  • 5
    Hard to tell without having the real domain name and not just an example. In general * includes -. But, abc-.domain.com is invalid anyway since a hostname must end with a letter or number and must not end with a -. See restrictions on valid hostnames. Oct 8, 2019 at 9:39
  • @SteffenUllrich: Thanks for your response. Since they don't want to change the name now I can't validate your approach, but I think this will be the reason. Could you post it as an answer?
    – testing
    Oct 8, 2019 at 10:56
  • 1
    FYI openssl s_client by default doesn't check the name(s) in the cert at all; it would accept even a cert for xyz.wrong.invalid. (This is partly because only some SSL/TLS protocols have a hostname, like HTTPS; for example SNMPS and FTPS may not.) You must add -verify_hostname $host to get any checking -- and then it applies RFC952+IDNA restrictions only for wildcard names, which yours is. But what OpenSSL does is irrelevant for browsers. Oct 22, 2021 at 1:39

1 Answer 1

5

As detailed by @SteffenUllrich in the comments, hostnames may contain a hyphen-minus (-) but this character may not appear either at the beginning or end of a hostname e.g.:

ex. Correct use of -

sub-domain.example.com

ex. Incorrect use of -

-subdomain-.example.com

The cited Wikipedia article provides a direct link to RFC 952, which states:

A "name" (Net, Host, Gateway, or Domain name) is a text string up to 24 characters drawn from the alphabet (A-Z), digits (0-9), minus sign (-), and period (.)

And regarding your particular case:

The last character must not be a minus sign or period.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.