4

I have a domain like this: https://abc-.domain.com/. If I open this site different browser are showing me different results. E.g. Firefox throws the error security risk. Chrome on the other side loads the site without issues.

If I call the domain https://abc.domain.com the site is opened in Firefox without issues. So the only difference I can see is the hypen -.

The certificate should be valid for the following subdomains/domains:

*.domain.com, domain.com

I tried to verfiy the certificate with openssl s_client -debug -connect abc-.domain.com:443 and can't find something wrong.

So is the hyphen not a valid wildcard character?

3
  • 5
    Hard to tell without having the real domain name and not just an example. In general * includes -. But, abc-.domain.com is invalid anyway since a hostname must end with a letter or number and must not end with a -. See restrictions on valid hostnames. Oct 8, 2019 at 9:39
  • @SteffenUllrich: Thanks for your response. Since they don't want to change the name now I can't validate your approach, but I think this will be the reason. Could you post it as an answer?
    – testing
    Oct 8, 2019 at 10:56
  • 1
    FYI openssl s_client by default doesn't check the name(s) in the cert at all; it would accept even a cert for xyz.wrong.invalid. (This is partly because only some SSL/TLS protocols have a hostname, like HTTPS; for example SNMPS and FTPS may not.) You must add -verify_hostname $host to get any checking -- and then it applies RFC952+IDNA restrictions only for wildcard names, which yours is. But what OpenSSL does is irrelevant for browsers. Oct 22, 2021 at 1:39

1 Answer 1

5

As detailed by @SteffenUllrich in the comments, hostnames may contain a hyphen-minus (-) but this character may not appear either at the beginning or end of a hostname e.g.:

ex. Correct use of -

sub-domain.example.com

ex. Incorrect use of -

-subdomain-.example.com

The cited Wikipedia article provides a direct link to RFC 952, which states:

A "name" (Net, Host, Gateway, or Domain name) is a text string up to 24 characters drawn from the alphabet (A-Z), digits (0-9), minus sign (-), and period (.)

And regarding your particular case:

The last character must not be a minus sign or period.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .