3 ms·

Why? If I own a domain, then declare that "administrators of this domain include: everyone.", then how is the cert invalidly issued? BTW we love CloudFlare. Bu

Why? If I own a domain, then declare that "administrators of this domain include: everyone.", then how is the cert invalidly issued? BTW we love CloudFlare. But the DNS limitations (no wildcards for SSL without $$$$/month, only top-level subdomains allowed) really hurt for developing things. The wildcard bit I understand (valuable service), the multi-level hostnames I don't get; sounds like some technical issue? I know you just get a wildcard for the root, but even paid I've been told there's no workaround. So I can't do [stuff].test.example.com.

jgrahamc 11y ago
*.example.com won't match foo.bar.example.com. That's a technical limitation of the way name matching works (similar to DNS); not a CloudFlare restriction. Our free Universal SSL certificate includes a wildcard (so if you sign up example.com you get *.example.com).
- MichaelGG 11y ago
  Right, but even in paid plans, there's no ability to get further subdomains. Just pointing that out and wondering why. Technical issue that isn't worth the effort?
- fanf2 11y ago
  Annoyingly, TLS wildcards have very a different meaning to DNS wildcards. DNS wildcards only work when * is the leftmost label of a domain name, so *.example.com is a wildcard foo.*.example.com is not a wildcard *bar.example.com is not a wildcard A DNS wildcard matches any non-zero number of labels, so *.example.com foo.example.com matches foo.bar.example.com matches example.com does not match RFC 4592 describes DNS wildcards. Unlike the DNS, the * in a TLS certificate can only match one label, so *.example.com foo.example.com matches foo.bar.example.com does NOT match example.com does not match RFC 2818 also allows the * to appear within a domain name, not just as the leftmost label, and wildcards work even when they are part of a label. One of its examples says f*.com foo.com matches bar.com does not match But nowadays sub-label wildcards like this are not supported.

jgrahamc 11y ago

*.example.com won't match foo.bar.example.com. That's a technical limitation of the way name matching works (similar to DNS); not a CloudFlare restriction. Our free Universal SSL certificate includes a wildcard (so if you sign up example.com you get *.example.com).

MichaelGG 11y ago
Right, but even in paid plans, there's no ability to get further subdomains. Just pointing that out and wondering why. Technical issue that isn't worth the effort?
fanf2 11y ago
Annoyingly, TLS wildcards have very a different meaning to DNS wildcards. DNS wildcards only work when * is the leftmost label of a domain name, so *.example.com is a wildcard foo.*.example.com is not a wildcard *bar.example.com is not a wildcard A DNS wildcard matches any non-zero number of labels, so *.example.com foo.example.com matches foo.bar.example.com matches example.com does not match RFC 4592 describes DNS wildcards. Unlike the DNS, the * in a TLS certificate can only match one label, so *.example.com foo.example.com matches foo.bar.example.com does NOT match example.com does not match RFC 2818 also allows the * to appear within a domain name, not just as the leftmost label, and wildcards work even when they are part of a label. One of its examples says f*.com foo.com matches bar.com does not match But nowadays sub-label wildcards like this are not supported.