SSL certificate not valid because wildcard doesn't match subdomain with hyphen?
I have a domain like this: https://abc-.domain.com/
. If I open this site different browser are showing me different results. E.g. Firefox throws the error security risk. Chrome on the other side loads the site without issues.
If I call the domain https://abc.domain.com
the site is opened in Firefox without issues. So the only difference I can see is the hypen -
.
The certificate should be valid for the following subdomains/domains:
*.domain.com
, domain.com
I tried to verfiy the certificate with openssl s_client -debug -connect abc-.domain.com:443
and can't find something wrong.
So is the hyphen not a valid wildcard character?
As detailed by @SteffenUllrich in the comments, hostnames may contain a hyphen-minus (-
) but this character may not appear either at the beginning or end of a hostname e.g.:
ex. Correct use of -
sub-domain.example.com
ex. Incorrect use of -
-subdomain-.example.com
The cited Wikipedia article provides a direct link to RFC 952, which states:
A "name" (Net, Host, Gateway, or Domain name) is a text string up to 24 characters drawn from the alphabet (A-Z), digits (0-9), minus sign (-), and period (.)
And regarding your particular case:
The last character must not be a minus sign or period.