Matching is performed using the matching rules specified by RFC2459. If more than one identity of a given type is present in the certificate (e.g., more than one dNSName name, a match in any one of the set is considered acceptable.) Names may contain the wildcard character * which is considered to match any single domain name component or component fragment. E.g., *.a.example matches foo.a.example but not bar.foo.a.example. f*.example matches foo.example but not bar.example.
如果您需要包含 *.domain.example 网站的通配符证书，并且还可以使用 sub1.sub2.domain.example 或其他域（如 *.domain2）。例如，您可以使用单个通配符证书来解决这个问题，该证书带有每个其他子域的主题备用名称 (SAN) 扩展。 SAN 证书不仅适用于多个特定主机名，还可以为通配符条目创建。
例如，*.domain.example、sub1.sub2.domain.example 和 *.domain2.example 的通用名称为*.domain.example 然后您将附加 *.domain2.example 和 *.sub2.domain.example 的主题备用名称。这可能取决于证书颁发机构如何向您收取（或不收取）证书费用，但有一些机构可以提供此服务。此外，SAN 支持在 Web 浏览器领域相当广泛。这种用途的最佳现实示例是 Google 的 SSL 证书。打开 Google 并查看其 SSL 证书，您将看到它适用于 *.google.com、*.youtube.com、*.gmail.com< /code>，以及更多它们被列为主题替代名称的地方。
If you need a wildcard certificate that contains *.domain.example sites and also work with sub1.sub2.domain.example or another domain like *.domain2.example, you can solve that with a single wildcard certificate with what is called a subject alternative name (SAN) extension for each of the other sub sub domains. A SAN cert is not just for multiple specific host names, it can be created for wildcards entries as well.
For example, *.domain.example, sub1.sub2.domain.example, and *.domain2.example would have a Common Name of *.domain.example then you would attach a subject alternative name of both *.domain2.example and *.sub2.domain.example. It might depend on the Certificate Authority as to how they would charge you (or not) for the certificate, but there are some out there where this offering is available. Also, SAN is support is pretty widespread in the web browser space. The best real world example of this use, it Google's SSL cert. Go open Google and view its SSL certificate, you will see it works for *.google.com, *.youtube.com, *.gmail.com, and a bunch more where they are listed as subject alternative names.
发布评论
评论（3）
*.example.net的通配符 SSL 证书将匹配sub.example.net，但不匹配sub.sub.example.net。来自 RFC 2818：
A wildcard SSL certificate for
*.example.netwill matchsub.example.netbut notsub.sub.example.net.From RFC 2818:
如果您需要包含
*.domain.example网站的通配符证书，并且还可以使用sub1.sub2.domain.example或其他域（如*.domain2）。例如，您可以使用单个通配符证书来解决这个问题，该证书带有每个其他子域的主题备用名称 (SAN) 扩展。 SAN 证书不仅适用于多个特定主机名，还可以为通配符条目创建。例如，
*.domain.example、sub1.sub2.domain.example和*.domain2.example的通用名称为*.domain.example然后您将附加*.domain2.example和*.sub2.domain.example的主题备用名称。这可能取决于证书颁发机构如何向您收取（或不收取）证书费用，但有一些机构可以提供此服务。此外，SAN 支持在 Web 浏览器领域相当广泛。这种用途的最佳现实示例是 Google 的 SSL 证书。打开 Google 并查看其 SSL 证书，您将看到它适用于*.google.com、*.youtube.com、*.gmail.com< /code>，以及更多它们被列为主题替代名称的地方。If you need a wildcard certificate that contains
*.domain.examplesites and also work withsub1.sub2.domain.exampleor another domain like*.domain2.example, you can solve that with a single wildcard certificate with what is called a subject alternative name (SAN) extension for each of the other sub sub domains. A SAN cert is not just for multiple specific host names, it can be created for wildcards entries as well.For example,
*.domain.example,sub1.sub2.domain.example, and*.domain2.examplewould have a Common Name of*.domain.examplethen you would attach a subject alternative name of both*.domain2.exampleand*.sub2.domain.example. It might depend on the Certificate Authority as to how they would charge you (or not) for the certificate, but there are some out there where this offering is available. Also, SAN is support is pretty widespread in the web browser space. The best real world example of this use, it Google's SSL cert. Go open Google and view its SSL certificate, you will see it works for*.google.com,*.youtube.com,*.gmail.com, and a bunch more where they are listed as subject alternative names.通配符仅应用于域的第一部分（从左侧）。 您将需要
*.sub2.domain.example的证书因此，如果您有
sub1.domain.example和sub2.domain.example<， /code>，那么它应该可以工作。The wildcard is only applied to the first part (from the left) of you domain. So you'll need a certificate for
*.sub2.domain.exampleIf you meant that you have
sub1.domain.exampleandsub2.domain.example, then it should work.