Doesn't that completely defeat the purpose of having the first domain verified by a certificate authority when the certificate also works on other domains?

How are they different from self-signed certificates other than web browsers not showing security errors?

The certificate in this picture was issued for sni.cloudflaressl.com but work correctly on ovongames.com Ovon games security certificate screenshot

1 Answer 1


You are again (see comments already on your previous question at https://webmasters.stackexchange.com/questions/123426/why-does-a-domain-validated-certificate-issued-by-certificate-authority-for-exam) missing the SAN (Subject Alternative Names) extension.

Current certificates use it to put multiple hostnames in a certificate. What you see in your "General" tab is only the "first" one, the one in the CN part of the certificate, which is in fact mostly ignored by browsers nowadays.

If you go to the "Details" tab you will see under "Certificate Subject Altername Names" (or something equivalent) this:

Not Critical
DNS Name: ovongames.com
DNS Name: sni.cloudflaressl.com
DNS Name: *.ovongames.com

Which means this certificate applies to all these hostnames.

At validation time (when certificate is issued), the CA has verified that the requestor of the certificate issuance has authority over all these names: there is no "first domain" there, all hostnames in the certificate request are verified by the CA before issuance, otherwise obviously if anyone can get a certificate for hostname X but also put inside hostnames Y and Z without verification then the certificate is worthless.

Section " Validation of Domain Authorization or Control" of the CAB Forum Baseline Requirements (a document all well known CAs follow) state this (emphasis mine):

The CA SHALL confirm that prior to issuance, the CA has validated each Fully-Qualified Domain Name (FQDN) listed in the Certificate using at least one of the methods listed below.

So that specific certificate behaves exactly (and provides exactly the same level of confidence/trust) than a certificate that would have been delivered ONLY for ovongames.com and/or *.ovongames.com.

Why a given certificate has all these names in it, versus a certificate with only one name (and the wildcard addition)? This is purely up to the providers managing the certificates, technically things work the same way (CA typically limits the number of names you can put in the SAN extension, like 100 of them, but at the opposite end of the scale one may want to have as few certificates to handle as possible, specifically if it hosts a lot of different websites).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.