Wildcard certificate

An example of a wildcard certificate on https://plus.google.com (note the asterisk: *)
An example of an EV certificate acting as a wildcard certificate on https://www.ssl.com (note the Subject Alternative Name (SAN) field)

In computer networking, a wildcard certificate is a public key certificate which can be used with multiple subdomains of a domain. The principal use is for securing web sites with HTTPS, but there are also applications in many other fields. Compared with conventional certificates, a wildcard certificate can be cheaper and more convenient than a certificate for each domain.[1]

Analogy

One analogy is that of a public notary which issues a public validation of a person's identity. An individual wishing to have her identity validated would submit her own name and some evidence of her residence and existence. The public notary would sign a document asserting the identity of the individual for a fee. The notary would risk his professional accreditation in doing so, which would presumably lead to a reasonable assessment of the person's identity as verified. Since the public could place some trust in a practicing lawyer doing such, the certification is an indication of the validity of the person's identity. In the computer realm, an individual website www.wikipedia.org is the person and the certification authority is the notary public.

The analog of a wildcard certificate would be as follows. During the same meeting, the person represents that they have several unidentified children. They also would like the notary public to certify all of those children as existing persons. The notary public at the same time signs a number of blank letters with empty spaces for the names of the children, and in that letter states that the certification is valid if there is DNA matching the person's own. A wildcard certificate would enable the person to represent to the public those children of the same surname and lineage, with the same force as their own identity. In this analog the Internet DNS is the DNA match. Since the person controls their own DNA it is unlikely they could represent a child as their own without a DNA match

Example

A single wildcard certificate for *.example.com, will secure all these domains:[2]

Because the wildcard only covers one level of subdomains (the asterisk doesn't match full stops),[3] these domains would not be valid for the certificate:

The "naked" domain is valid when added separately as a SubjectAltName:[4]

Note possible exceptions by CAs, for example wildcard Plus cert by DigiCert contains an automatic "Plus" property for the naked domain example.com

Brief information about wildcard ssl certificate.

Limitation

Only a single level of subdomain matching is supported.[5]

It is not possible to get a wildcard for an Extended Validation Certificate.[6] A workaround could be to add every virtual host name in the Subject Alternative Name (SAN) extension,[7][8][9] the major problem being that the certificate needs to be reissued whenever a new virtual server is added.[10]

Wildcards can be added as domains in multi-domain certificates or Unified Communications Certificates (UCC).[11] In addition, wildcards themselves can have subjectAltName extensions, including other wildcards. For example: The wildcard certificate *.wikipedia.org has *.m.wikimedia.org as a Subject Alternative Name. Thus it secures https://www.wikipedia.org as well as the completely different website name https://meta.m.wikimedia.org.[12]

RFC 6125 argues against wildcard certificates on security grounds.[13]

See also

References

  1. ↑ Hendric, William (17 January 2008). "Wildcard SSL Certificate Explained". SSL Certificate Provider. Retrieved 17 February 2015.
  2. ↑ Hendric, William (17 June 2008). "Wildcard SSL Certificate Features". Comodo SSL. SSL Certificate Provider. Retrieved 17 February 2015.
  3. ↑ "RFC 2818 - HTTP Over TLS". Internet Engineering Task Force. May 2000. p. 5. Retrieved 2014-12-15. [...] *.a.com matches foo.a.com but not bar.foo.a.com.
  4. ↑ "RFC 2595 - Using TLS with IMAP, POP3 and ACAP". Internet Engineering Task Force. June 1999. p. 3. Retrieved 2014-12-15. For example, *.example.com would match a.example.com, foo.example.com, etc. but would not match example.com.
  5. ↑ Wildcard SSL certificate limitation on QuovadisGlobal.com
  6. ↑ "Guidelines For The Issuance And Management Of Extended Validation Certificates, Version 1.5.2" (PDF). CA/Browser Forum. 2014-10-16. p. 10. Retrieved 2014-12-15. Wildcard certificates are not allowed for EV Certificates.
  7. ↑ x509v3_config-Subject Alternative Name
  8. ↑ The subjectAltName field
  9. ↑ The SAN option is available for EV SSL Certificates on Symantec.com
  10. ↑ Need to be reissued whenever a new virtual server is added
  11. ↑ Wildcard domains can be used within UCC on SSL.com
  12. ↑ SSLTools Certificate Lookup of Wikipedia.org's wildcard ssl certificate
  13. ↑ "RFC 6125 - Representation and Verification of Domain-Based Application Service Identity within Internet Public Key Infrastructure Using X.509 (PKIX) Certificates in the Context of Transport Layer Security (TLS)". Internet Engineering Task Force. March 2011. p. 31. Retrieved 2014-12-10. This document states that the wildcard character '*' SHOULD NOT be included in presented identifiers but MAY be checked by application clients (mainly for the sake of backward compatibility with deployed infrastructure). [...] Several security considerations justify tightening the rules: [...]

Relevant RFCs

This article is issued from Wikipedia - version of the Monday, April 18, 2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.