Closed tbjornli closed 1 year ago
Hi! It is the expected behaviour of TLS certificates that '' only matches a single level. So a certificate issued for `.example.comwill match
name1.example.combut will not work for
name1.sub1.example.com. This is a TLS limitation not something related to
mod_md`
As @whereisaaron said. *.domain.com
only works on the first level. No browser will recognize a cert like *.*.domain.com
. It is explicitly prohibited to do so by the standards. Nor is CA like Lets Encrypt or others allowed to do so.
Oh, I was actually not aware of that this is a limitation in TLS.
Thank you!
Pre v2.4.0
Up until v2.4.0, in order to secure more than one sub-domain I needed to include them all in the MDomain directive, like this:
However, this did not work for multi-level so for these specific vhosts I needed this config:
Post v2.4.0
Now that I am using Apache 2.4.52 which include mod_md v2.4.8 from what I can see, I can reduce the first bit of the configuration to this
Problem
However this wildcard configuration does not seem to cover multi-level subdomains like multi-level.sub1.domain.tld and I am still required to keep the configuration multi-level.sub1.domain.tld.conf (as above).
If I remove this configuration I see the following error message in the multi-level.sub1.domain.tld.log file
It seems strange to me that one should need the extra configuration for multi-level subdomains which should be covered by the wildcard certificate.
Any idea why this is not working? Is it not supported, did I stumble upon a bug or am I doing something wrong?