Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know that an SSL wildcard certificate (*.example.org) can be used to support many names under the domain (a.example.org, b.example.org, c.example.org). I also know that the * is only good for matching a single level of name. That is, *.example.org will not work on a.b.example.org.

What if I used a certificate with the name ..example.org? I'd like to build a certificate with the following name configuration:

subjectAltName=DNS:example.org, DNS:*.example.org, DNS:*.*.example.org, DNS:*.*.*.example.org

I've tried building a few like this as self-signed certificates, but I've not had good results. For example, chrome tells me "Server's certificate does not match the URL."

Is it possible to have nested wildcards in a certificate, or do the popular browsers not support this?

edit I believe it's possible to build a cert like this: I've done so with OpenSSL. It just looks like browsers understand it. I was hoping for confirmation of that, or if I'm lucky, a "here's how you do it."

share|improve this question
What would be the point? why not just use hyphens to separate... – Simon Hayter Mar 14 '13 at 15:55
Because that's a "wrong" use of DNS (in my case). I might have an application that has multiple servers. So, I might create a DNS subzone "app1.example.com" and put all my app1 servers behind it. I could just get another wildcard for *.app1.example.com, but if I could get a cert with CN=*.example.com, SAN=[example.com *.*.example.com], I could put that on a load balancer and have it work for most situations. – Don Faulkner Nov 8 '13 at 17:01

Some SSL cert providers do something similar to this by providing a "subject alternative name" feature within their wildcard certs.

Digicert apparently does this but I'm not sure if Verisign does.


share|improve this answer
It doesn't appear that Digicert allows you to put another wildcard in as a SAN, at least, their documentation doesn't read that way. – Don Faulkner Nov 8 '13 at 16:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.