-1

I have a website running on AWS that needs SSL. The website has the functionality that it must by white labelable according to the subdomain accessed. For example, when accessing www.a.the-site.com the website will look different from when it is accessed from www.b.the-site.com, but it is the same virtual host handling both urls. I use an ELB which directs to the EC2 instance (only one instance at this stage) This worked fine when running over normal http.

I followed the step by step tutorial on AWS (http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/ssl-server-cert.html and http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/elb-create-https-ssl-load-balancer.html#configure-https-listener) to generate the keys (steps laid out below for ease of reference) and got the certificate from GoDaddy. (Upon pasting the CSR on the GoDaddy website's certificate request process, the correct CN was displayed). The certificate bought was a wildcard certificate, to support different subdomains. I applied the Certificate on the ELB using the AWS website interface, which did not prompt any errors, but now when I access the site over https, I get the SSL error in the browser:

"The security certificate presented by this website was issued for a different website's address."

Investigating the Certificate on https://www.sslshopper.com shows the following:

enter image description here

It states that none of the common names match, yet the common name in the chain is correct (*.the-site.com)

I can also post the steps followed to create the private key and CSR, but I have not received any indication that these are incorrect. It seems like the CN *.the-site.com is not resolving www.a.the-site.com. Can anyone shed some light on this?

Martijn Pieters
  • 1,048,767
  • 296
  • 4,058
  • 3,343
BOENDAGGER
  • 423
  • 5
  • 21
  • 1
    That is correct behavior. The `*` in a wildcard SSL certificate only covers/matches one level of hostnames, so `a.example.com` will match but `www.a.example.com` will not match. Your solution (workaround) will be to configure your platform to take the incoming `Host:` header, if `www.` is found, strip it, and redirect the browser `301 Moved Permanently` with `Location: https://a.example.com` so that the "www" link works when used without https. Published HTTPS links will need to exclude the www prefix. – Michael - sqlbot Oct 25 '15 at 17:56
  • 1
    Possible duplicate of [Problems with SSL and multi level subdomains](http://stackoverflow.com/questions/5295521/problems-with-ssl-and-multi-level-subdomains) – Michael - sqlbot Oct 25 '15 at 17:57

1 Answers1

0

@Michael - sqlbot was correct, the wildcard certificate only checks for a single domain. I changed my domain settings to not redirect to www.a.example.com, but rather a.example.com (dropping the www subdomain) and all is working as expected.

BOENDAGGER
  • 423
  • 5
  • 21