We have a website and we'd like to check if the certificate installed is a wild-card certificate or tied to the specific URL only. Could this be checked in an easy way?
6 Answers
Browse to a secured page on your server, ie: https://yoursite.com
Click on the padlock in the URL bar and view the certificate. To do this in Chrome you click on the Connection
tab then Certificate Information
.
Check that the Common Name (CN)
contains a * in front of your domain name.
Eg. for https://www.google.com
-
5This is answer is a little inaccurate, or rather; incomplete. The
Common Name
for a wildcard certificate does not need to start with an asterisk (e.g., it can be instead listed simply as "example.com"). In that case a header namedExtensions
should be shown belowFingerprints
containing an item called Certificate Subject Alternative Name with domain values including the wildcard "*.example.com" value.– WillApr 22, 2018 at 2:58
This can be done by checking for the common name in the SSL's subject. You can use the bash command openssl
on *NIX clients.
For instance, google.com and www.google.com use two different SSLs. The first is a wildcard, the second is domain specific.
$ echo | openssl s_client -connect google.com:443 2>/dev/null | openssl x509 -noout -subject | grep -o "CN=.*" | cut -c 4-
*.google.com
$ echo | openssl s_client -connect www.google.com:443 2>/dev/null | openssl x509 -noout -subject | grep -o "CN=.*" | cut -c 4-
www.google.com
You could look up the cert at its issuer-- you should be able to see there whether it's issued to *.domain.com or www.domain.com. Eg, Verisign.
-
-
1If " *.domain.com " then wildcard and if "www.domain.com" or "pay.domain.com" then domain specific ! Jul 2, 2015 at 8:14
Similar to other online tools for web purposes, I found this handy too, quite simple replace your hostname with your https siteurl it will explain what problem you are going through, and what solutions can benefit you...
https://www.sslshopper.com/ssl-checker.html#hostname={siteurl}
-
1
Additionally, you can use free online tools like https://www.ssllabs.com/ssltest. Besides the domain info, they will also tell you other important detail about your certificate.
Using command line openssl client, this can be checked as follows, on all UNIX like systems:
SERVERNAME=google.com; echo | openssl s_client -showcerts -connect $SERVERNAME:443 -servername $SERVERNAME 2>/dev/null| grep subject | grep -o "CN=.*"
This is an improvement over the Steve Robbins answer above.