0

Context

I work with multiple environments that are continuously created/destroyed. The instances in these environments can be joined like that:

<instance>.<environment>.<vpc>.domain.com

where <environement> changes all the time

Certificates

I have created one self-signed certificates for each VPCs:

  • *.*.vpc0.domain.com
  • *.*.vpc1.domain.com
  • etc

So it's multi-subdomain wildcard certificates (no sure if there is a common name for that).

Proxy

I have setup some proxy with nginx. The certificates are setup and I can join my backend services by using virtual hosting and SSL. As expected, my browser tells me that the certificate is not trusted if I call the service.

My problem

Some of the backend services need to access other backend services through this kind of proxy in SSL. My problem rise with the not trusted certificate error.

The problem is that adding the certificate to the Windows Trusted Root Certification Authorities doesn't solve this issue. I continue to have the error when I/service try to join a service in SSL.

Side notes

  • The setup of a one level wildcard certificate works fine. For example *.environment0.vpc0.domain.com is detected in the windows Trusted Root and the error goes away.
  • I don't want to desactivate this certificate control
  • There are other solutions to achieve the same kind of design, my question focus on understanding why this 2 levels certificate is not detected when in the store

Regards

Thibault Deheurles
  • 1,211
  • 13
  • 21
  • Thanks for this @steffen. So you confirm that 2 levels subdomains with wildcard doesn't exist ? I did see this post but have other informations on web telling that it exists. – Thibault Deheurles Aug 25 '16 at 17:32
  • a wildcard can only be in the left-most label. There is only one left-most label, so only one wildcard is possible. See http://stackoverflow.com/questions/34138011/what-is-the-format-of-wildcard-certificate-name for more details. And there were various bugs in applications and libraries which have implemented this wrong. – Steffen Ullrich Aug 25 '16 at 17:42
  • thank you @steffen – Thibault Deheurles Aug 25 '16 at 17:48

0 Answers0