I have a domain like this: https://abc-.domain.com/
. If I open this site different browser are showing me different results. E.g. Firefox throws the error security risk. Chrome on the other side loads the site without issues.
If I call the domain https://abc.domain.com
the site is opened in Firefox without issues. So the only difference I can see is the hypen -
.
The certificate should be valid for the following subdomains/domains:
*.domain.com
, domain.com
I tried to verfiy the certificate with openssl s_client -debug -connect abc-.domain.com:443
and can't find something wrong.
So is the hyphen not a valid wildcard character?
*
includes-
. But,abc-.domain.com
is invalid anyway since a hostname must end with a letter or number and must not end with a-
. See restrictions on valid hostnames.openssl s_client
by default doesn't check the name(s) in the cert at all; it would accept even a cert forxyz.wrong.invalid
. (This is partly because only some SSL/TLS protocols have a hostname, like HTTPS; for example SNMPS and FTPS may not.) You must add-verify_hostname $host
to get any checking -- and then it applies RFC952+IDNA restrictions only for wildcard names, which yours is. But what OpenSSL does is irrelevant for browsers.