2

I've searched through https://developer.mozilla.org/en-US/ and Google and still cannot learn exactly why Firefox would display it's "This Connection is Untrusted" screen/UI with "(Error code: ssl_error_bad_cert_domain)" under "Technical Details".

Is it really as simple as "The SSL certificate common name does not match the fully qualified domain name (FQDN) of the webserver/website." ?

If so, then why wouldn't an SSL certificate with the common name "*.subdomain.mydomain.tld" work with the website "https://subdomain.mydomain.tld" and throw this specific error?

1
  • 1
    "... Fully qualified domain name (FQDN)" - FQDNs end in a dot ".". There's nothing else to them. www. and www.example.com. are FQDN; www and www.example.com are not. Browsers regularly mishandle FQDNs. For example, if I enter wiki. in my browser bar (note the trailing dot), the browser will take me to a search for wiki rather than connecting to the host named wiki on our network.
    – jww
    Mar 14, 2015 at 0:12

1 Answer 1

8

If so, then why wouldn't an SSL certificate with the common name "*.subdomain.mydomain.tld" work with the website "https://subdomain.mydomain.tld" and throw this specific error?

A wildcard stands for a single label and not for nothing. That means *.subdomain.example.com does not match subdomain.example.com but it will match foo.subdomain.example.com. To match subdomain.example.com too the certificate has to include both *.subdomain.example.com and also subdomain.example.com as subject alternative names. Note that *.example.com would also match subdomain.example.com but not foo.subdomain.example.com.

1
  • 1
    I misread en.wikipedia.org/wiki/Wildcard_certificate; "The "naked" domain is also not valid[13] (it must be added separately as a SubjectAltName)" (my bold emphasis). So my certificate is in fact incorrect in the way Firefox has thrown, for the reason given here (need SubjectAltName). support.godaddy.com/help/article/567/… confused me by stating otherwise, presumably because their sold certs must already have the naked domain name included as a SubjectAltName. Mar 13, 2015 at 23:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.