I know that an SSL wildcard certificate (*.example.org) can be used to support many names under the domain (a.example.org, b.example.org, c.example.org). I also know that the * is only good for matching a single level of name. That is, *.example.org will not work on a.b.example.org.

What if I used a certificate with the name ..example.org? I'd like to build a certificate with the following name configuration:

subjectAltName=DNS:example.org, DNS:*.example.org, DNS:*.*.example.org, DNS:*.*.*.example.org

I've tried building a few like this as self-signed certificates, but I've not had good results. For example, chrome tells me "Server's certificate does not match the URL."

Is it possible to have nested wildcards in a certificate, or do the popular browsers not support this?

edit I believe it's possible to build a cert like this: I've done so with OpenSSL. It just looks like browsers understand it. I was hoping for confirmation of that, or if I'm lucky, a "here's how you do it."

  • What would be the point? why not just use hyphens to separate... Commented Mar 14, 2013 at 15:55
  • Because that's a "wrong" use of DNS (in my case). I might have an application that has multiple servers. So, I might create a DNS subzone "app1.example.com" and put all my app1 servers behind it. I could just get another wildcard for *.app1.example.com, but if I could get a cert with CN=*.example.com, SAN=[example.com *.*.example.com], I could put that on a load balancer and have it work for most situations. Commented Nov 8, 2013 at 17:01

1 Answer 1


Some SSL cert providers do something similar to this by providing a "subject alternative name" feature within their wildcard certs.

Digicert apparently does this but I'm not sure if Verisign does.


  • It doesn't appear that Digicert allows you to put another wildcard in as a SAN, at least, their documentation doesn't read that way. Commented Nov 8, 2013 at 16:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.