0

I've set up a development server where I need to test a large number of LAMP sites. Their domain names are in a format such as:

https://webapp1.test.example.com
https://anotherwebapp.test.example.com
https://anotherclientssite.test.example.com

I want to get SSL certificates for them. Since getting a certificate for each of them is a hassle, I decided to use Let's Encrypt and certbot to get a wildcard SSL certificate for *.example.com...

...but now, after installing the certificates, I still can't get the browsers to trust them; they still display a warning about how the certificate can't be trusted. In Firefox's case, the error is "SSL_ERROR_BAD_CERT_DOMAIN", and it says that "This certificate is not valid for webapp1.test.example.com. The certificate is valid only for the following domains: *.example.com, example.com".

The command I used to generate the certificate was:

certbot certonly --manual --preferred-challenges dns --server https://acme-v02.api.letsencrypt.org/directory --manual-public-ip-logging-ok -d '*.example.com' -d example.com

How can I generate a wildcard certificate that is trusted by default by all browsers?

PaulJ
  • 1,646
  • 5
  • 33
  • 52

1 Answers1

1

Yes, but wildcards don't quite work like that. *.example.com will match foo.example.com and bar.example.com but not foo.bar.example.com.

Because multiple wildcards aren't allowed, you can't work around this by using *.*.example.com. You can, however, add *.test.example.com, along with any other subdomains you're testing, i.e.:

certbot certonly ... -d '*.test.example.com' -d '*.example.com' -d example.com
wetwarebug
  • 56
  • 3
  • This matching rule is defined and explained in §6.4.3 of RFC 6125 "Representation and Verification of Domain-Based Application Service Identity within Internet Public Key Infrastructure Using X.509 (PKIX) Certificates in the Context of Transport Layer Security (TLS)". – Patrick Mevzek Feb 13 '20 at 23:30
  • @PatrickMevzek although 6125 does not apply to HTTPS, see 1.4 and B.2; 2818 does, and says effectively the same thing. CABforum BR 3.2.2.6 also prohibits issuance of a cert with the (single) wildcard immediately to the left of a 'public suffix' i.e. a registry namespace, and at least Firefox checks this clientside. – dave_thompson_085 Feb 14 '20 at 00:27