通配符证书不适用于子域

Question

我创建了一个适用于

xxx.domain.com

但不适用于

aaa.bbb.domain.com

的通配符证书

创建证书时：

Common Name (e.g. server FQDN or YOUR name) []:*.domain.com

但似乎还不够。

Answer 1

通配符 SSL 证书仅匹配一级。见

• SSL 和多级子域的问题
• 通配符ssl证书不覆盖www版本，如何修复？
• SSL 多级子域通配符
• https://serverfault.com/questions/296390/ssl-domain-problem-for-signed-asterisk-certificates
• https://serverfault.com/questions/645230/why-does-my-wildcard-ssl-certificate-cause-a-domain-mismatch-error-on-a-second-l
• https://serverfault.com/questions/87869/ssl-certificates-for-subdomain-example-com
• https://serverfault.com/questions/104160/wildcard-ssl-certificate-for-second-level-subdomain
• https://serverfault.com/questions/871171/cant-secure-sub-domain-with-ssl
• https://serverfault.com/questions/817255/difference- Between-wild-card-ssl
• https://security.stackexchange.com/questions/83245/ssl-cert-for-sub-domain-com-and-www-sub-domain-com
• https://security.stackexchange.com/questions/158332/what-are-wildcard-certificate-limitations-in-san-extension