Take the 2-minute tour ×

I'm running a server "myserver.net", which has the subdomains "a.myserver.net" and "b.myserver.net".

When creating (self-signed) SSL certificates, I have to create one for every subdomain, containing the FQDN, even though those subdomains are just vhosts.

OpenSSL permits only one "common name", which is the domain in question. Is there any possibility to create a certificate that is valid for all subdomains of a domain?

share|improve this question

2 Answers 2

up vote 11 down vote accepted

Yes, use *.myserver.net as common name.

This is called wildcard certs and there are large number of howtos finding with this keyword.

Here is one of them: http://www.justinsamuel.com/2006/03/11/howto-create-a-self-signed-wildcard-ssl-certificate/

Update: if you want cert to match root domain as well (myserver.net), then you should use Subject Alternative Name extension. When generating cert using openssh enter '*.myserver.net/CN=myserver.net' as Common Name.

Compatibly is good enough, unless you have an ancient browser.

share|improve this answer
Ok, but is the certificate valid for the root-domain ("myserver.net") as well, or just for all subdomains? –  polemon Apr 6 '11 at 7:40
No, but you could add Subject Alternative Name: use '*.myserver.net/CN=myserver.net' as common.name. See here: artins.org/ben/… and here: digicert.com/subject-alternative-name-compatibility.htm –  rvs Apr 6 '11 at 11:32

It's a valid question. Unfortunately from what I understand the protocols never intended the owner of a domain to be able to sign certificates for just subdomains.

You are either a CA for anything or nothing. There is no limitation in scope once you are a CA.

Stupid but that's the way it is. Just buy a separate certificate for every single domain that you own $$$, that's right every single one, so don't bother trying to secure embedded devices that you sell.

share|improve this answer
No, this is wrong. First, see the other answer here, second, read up on what a certificate authority actually is. I have a CA for my internal domain only. There very much are scope limitations for CAs. –  HopelessN00b Oct 11 '12 at 14:38

Your Answer


