Wildcard in (not as) a hostname in a certificate's SAN

378 Views Asked by At

I know it's possible to have a wildcard as a hostname in the SAN of a certificate, like *.example.com. However, can you put *-test.example.com in the SAN? I found out you can't put that in DNS even though I couldn't find anything on that, so I'm wondering whether you could put it in the SAN.

1

There are 1 best solutions below

0
On

Thanks, Dallas, I somehow missed that Wikipedia page.

I think the killer for this is: "As of 2011, partial wildcard support is optional, and is explicitly disallowed in SubjectAltName headers that are required for multi-name certificates.", but also: "All major browsers have deliberately removed support for partial-wildcard certificates;[12][13] they will result in a "SSL_ERROR_BAD_CERT_DOMAIN" error."

So, it's a no-no.