45

Does anyone know if it's possible to create my own wildcard certificate under Ubuntu? For instance, I want the following domains to use one certificate:

https://a.example.com
https://b.example.com
https://c.example.com

1 Answer 1

75

Just follow one of the many step by step instructions for creating your own certificate with OpenSSL but replace the "Common Name" www.example.com with *.example.com.

Usually you have to keep a bit more money ready to get a certificate for this.

> openssl req -new -x509 -keyout cert.pem -out cert.pem -days 365 -nodes
Country Name (2 letter code) [AU]:DE
State or Province Name (full name) [Some-State]:Germany
Locality Name (eg, city) []:nameOfYourCity
Organization Name (eg, company) [Internet Widgits Pty Ltd]:nameOfYourCompany
Organizational Unit Name (eg, section) []:nameOfYourDivision
Common Name (eg, YOUR name) []:*.example.com
Email Address []:webmaster@example.com

(Sorry, my favorite howto is a german text that I don't have readily available and can't find currently, thus the 'many' links)

Edit in 2017: The original answer to this question is from 2009, when the choice for certificates did not include fully automated and free options like Let's Encrypt. Nowadays (if the "domain-validated" certification level of Let's Encrypt is enough for your purpose) it's trivial to obtain individual certificates for each and every subdomain. In case you need a higher trust level than domain-validated, wildcard certificates are still an option.

Also from 2017, note the comment below, by @ha9u63ar:

According RFC 2818 sec. 3 using CN for host name identification is not recommended anymore (deprecated) Subject Alternative Name (SAN) seems to be the way to go.

My answer to this comment: I trust that nowadays any CAs that issue Wildcard certs will have a proper set of instructions. For a self-signed quick fix, I'd not worry. On the other hand, with LetsEncrypt being around these days, it's been a long time since I've created a self-signed certificate. Gee, this answer really shows its age.

9
  • 1
    Can I run that from any host or just the one from where my sites reside on? Nov 30, 2009 at 21:23
  • 1
    You can use that on any host. But if the request goes to www.example.net while the certificate is for *.example.com (note the net/com difference) you'll get the usual non-matching-certificate warning. However, you can have a number of different machines, one serving www.example.com, another a.example.com, b.example.com etc. and all machines use the same certificate. It breaks only when you access them with a non-matching domain name.
    – Olaf Kock
    Dec 1, 2009 at 9:00
  • 4
    I believe this works for https://xyz.example.com, but not for https://example.com. Google for the SAN (subjectAltName) extension.
    – mivk
    Jan 1, 2014 at 22:56
  • Just to add the German tutorial that @OlafKock mentioned (for people like me), I guess it is this one here which is very complete and understandable (IMHO).
    – taffit
    May 31, 2016 at 10:28
  • 2
    According RFC 2818 sec. 3 using CN for host name identificate is not recommended anymore (deprecated) Subject Alternative Name (SAN) seems to be the way to go.
    – ha9u63a7
    Aug 8, 2017 at 15:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.