3 ms·
FYI, one major website which relies on subjectAltName which many of you will be aware of is github. The CommonName is ".github.com" which means it wouldn't be v
by mike-cardwell 16y ago
FYI, one major website which relies on subjectAltName which many of you will be aware of is github. The CommonName is ".github.com" which means it wouldn't be valid for https://github.com/ https://github.com/, but they also have "github.com" in the subjectAltName field.
https://www.cacert.org/ https://www.cacert.org/ also lets you generate certificates for multiple domains using subjectAltName. My website at https://secure.grepular.com/ https://secure.grepular.com/ has a CN of ".cardwellit.com", but then has three values in subjectAltName, "cardwellit.com", "grepular.com" and "*.grepular.com"
- mike-cardwell 16y agoThe comment system here has munged the above. Anywhere you see an opening double quotation mark followed by a full stop, there should be an asterisk inbetween the two.
- uxp 16y agoFor future reference, any text between two asterisks will be italicized, as you probably already know, but any escaped asterisk will show up as an asterisk ( \* ). Edit: or maybe not.
- hinathan 16y agoNote that the subjectAltName method GitHub is using doesn't seem to work with stock version of curl and wget on Debian (throws a cert error)
- mike-cardwell 16y agoYeah, I noticed this recently too as Debian is my server OS of choice. I'm surprised they haven't been updated yet. Maybe they have, and Debian hasn't been updated yet?
- nphase 16y agoI wonder if this is why wget'ing from github always returns me the --no-check-certificate error: ERROR: certificate common name `*.github.com' doesn't match requested host name `github.com'.
- mike-cardwell 16y agoYes, that is the reason. wget doesn't seem to have been updated to support subjectAltName yet. If you do a search for "wget subjectAltName" you'll see that patches have been submitted for such support. I guess support will be rolled out eventually.