Home / server / Questions / 1003415
In Process
FreeSoftwareServers
Asked: 2020-02-18 08:50:22 +0800 CST

How can SSL work with "subdomain" but not "subdomain.subdomain.domain.com"

  • 772

I'm investigating an SSL setup and Chrome says the cert was issues to, subdomain.subdomain.domain.com but if I visit that URL I get the "Cert Invalid" warning". Yet, if I visit "subdomain" directly, the cert is accepted. I'm not 100% how you even setup a site to not have a ".com/org" etc let alone get SSL to work in this sense. Does anybody have any ideas/experience with how this might be setup/possible?

internal-dns ssl ssl-certificate

2 Answers

  1. subdomain.subdomain.domain.com is a little bit confusing. Unifying might help for explanation:

    A subdomain is every part left of the most right dot. Only the most right part (com) is no subdomain. It is a Top Level Domain (TLD).

    Terminology:

    subsubdomain.subdomain.domain.com
       |         |        |    |
       |         |        |     \---> TLD: Top Level Domain
       |         |         \--------> SLD: 2nd/Second Level Domain
       |          \----------------->      3rd/Third Level Domain
        \--------------------------->      4th/Fourth Level Domain

    Every certificate is issued for only one CN (Common Name).

    In case the CN is the 3rd Level Domain subdomain.domain.com, Chrome will work only with this domain without errors.

    Every additional subdomain needs to be added as Alternativ Name. Otherwise you will get an error. A common usecase is the www. subdomain which is added as Alternativ Name.

    Multiple domains could be added. It is possible to get a certificate for mydomain.net (CN) with multiple Alternative Names included like: www.mydomain.net, smtp.mydomain.net, my-other-domain.com and www.my-other-domain.com

    As mentioned above, Alternative Names do not have to belong to the same "domain".

    Wildcard Certificates like *.google.com are another option without propagating "all your domains" to public. Data for every issued certificate will be accessible for everyone. (e.g. %.google%.com resolves google, googlemail, googleapis,...)

    • 3

  2. What had happened is we have a self-signed cert for "subdomain" and a public/ca signed cert for "subdomain.subdomain.domain.tld". We were using the self signed cert. When I switched to the public cert, only the proper URL would work for SSL.

    • 0