Subject: Wildcard certificates

From: Andrew Pollock <[email-masked]>
Date: Tue, 29 Jan 2002 10:56:16 +1000

Hi,

Please direct me to the OpenSSL mailing list if this question is more
appropriate over there...

I'm trying to roll my own wildcard certificate (i.e. where the CN =
*.domain.com)

I'm assuming there's more to it than just putting an asterisk in the CN field?

Any pointeres appreciated. I've googled like crazy and found a lot of questions
but nothing really helpful in the answer department...

Andrew
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: "Julian C. Dunn" <[email-masked]>
Date: Mon, 28 Jan 2002 20:09:23 -0500 (EST)

> I'm assuming there's more to it than just putting an asterisk in the CN

Nope... there's no more to it than that. At least that's the experience
I've had. Apache will complain (warn) that your CN doesn't match the name
of the server, but everything works fine. I'm using Apache 1.3.12 with
modssl 2.6.6.

- Julian

---

From: Andrew Pollock <[email-masked]>
Date: Tue, 29 Jan 2002 14:29:37 +1000

> of the server, but everything works fine. I'm using Apache 1.3.12 with

Hmm, I'm not aware of any complaints from Apache, however Internet Explorer (6)
is complaining that the name on the certificate doesn't match the hostname...

Andrew

---

From: "Julian C. Dunn" <[email-masked]>
Date: Mon, 28 Jan 2002 23:45:14 -0500 (EST)

On Tue, 29 Jan 2002, Andrew Pollock wrote:

> Hmm, I'm not aware of any complaints from Apache, however Internet
> Explorer (6) is complaining that the name on the certificate doesn't
> match the hostname...

Is that when you go to https://sitename.com as opposed to
https://www.sitename.com/? In the former case, I believe the wildcard will
not work because there is nothing for the "*" to match.

Of course, you could just write a mod_rewrite rule (or use another such
mechanism) to force people to use the latter version.

- Julian

--
Julian C. Dunn, B.A.Sc <[email-masked]>
Senior Software Developer, VerticalScope Inc.
Tel.: (416) 341-8950 x236  Fax: (416) 341-8959
WWW: www.verticalscope.com

"Windows NT encountered the following error:
The operation was completed successfully."

---

From: Andrew Pollock <[email-masked]>
Date: Tue, 29 Jan 2002 23:04:20 +1000

> not work because there is nothing for the "*" to match.

No, it's two subdomains of the same domain.

https://ops.suretyit.com.au/
https://sales.suretyit.com.au/

I want a certificate where I'm the CA that behaves like the one at
https://registry.connect.com.au/

---

From: "Julian C. Dunn" <[email-masked]>
Date: Tue, 29 Jan 2002 08:35:50 -0500 (EST)

> https://sales.suretyit.com.au/

That's because you're trying to use a cert that has its CN as
*.singtech.com.au, and the site(s) you are using it on are
*.suretyit.com.au.

- Julian

---

From: Andrew Pollock <[email-masked]>
Date: Wed, 30 Jan 2002 08:10:55 +1000

> *.singtech.com.au, and the site(s) you are using it on are

Somebody shoot me.

---

From: James Cloos <[email-masked]>
Date: Fri, 1 Feb 2002 06:47:26 -0500

> I'm assuming there's more to it than just putting an asterisk in the CN field?

While CN="*.domain.com" is the typical thing to do, I've found that netscape and
mozilla (though I've not tried it with the latest versions) had no problem accepting
a cert where CN='domain.com' for any machine foo.domain.com.

I never had an opportunity to try it myself w/ ie or opera, but I never got any
complaints from users of them either.

Whether the behavior I saw is best considered a bug or a feature, I'll leave to debate.

-JimC