We have a website and we'd like to check if the certificate installed is a wild-card certificate or tied to the specific URL only. Could this be checked in an easy way?
4 Answers
Browse to a secured page on your server, ie: https://yoursite.com
Click on the padlock in the URL bar and view the certificate. To do this in Chrome you click on the Connection
tab then Certificate Information
.
Check that the Common Name (CN)
contains a * in front of your domain name.
Eg. for https://www.google.com
-
4This is answer is a little inaccurate, or rather; incomplete. The
Common Name
for a wildcard certificate does not need to start with an asterisk (e.g., it can be instead listed simply as "example.com"). In that case a header namedExtensions
should be shown belowFingerprints
containing an item called Certificate Subject Alternative Name with domain values including the wildcard "*.example.com" value.– WillApr 22, 2018 at 2:58
This can be done by checking for the common name in the SSL's subject. You can use the bash command openssl
on *NIX clients.
For instance, google.com and www.google.com use two different SSLs. The first is a wildcard, the second is domain specific.
$ echo | openssl s_client -connect google.com:443 2>/dev/null | openssl x509 -noout -subject | grep -o "CN=.*" | cut -c 4-
*.google.com
$ echo | openssl s_client -connect www.google.com:443 2>/dev/null | openssl x509 -noout -subject | grep -o "CN=.*" | cut -c 4-
www.google.com
You could look up the cert at its issuer-- you should be able to see there whether it's issued to *.domain.com or www.domain.com. Eg, Verisign.
-
-
1If " *.domain.com " then wildcard and if "www.domain.com" or "pay.domain.com" then domain specific ! Jul 2, 2015 at 8:14
Similar to other online tools for web purposes, I found this handy too, quite simple replace your hostname with your https siteurl it will explain what problem you are going through, and what solutions can benefit you...
https://www.sslshopper.com/ssl-checker.html#hostname={siteurl}
-
1