Subject: [pkix] How do or don't multi-name wildcard certs work?

From: "John Levine" <[email-masked]>
Date: 5 Apr 2018 10:49:45 -0400

One day I decided to build a content farm, which you can find
at http://www.web.sp.am.  Click on a few of the links and you
will see that it consists of a very large set of similar pages
with names like <a>.<b>.<c>.web.sp.am.

On the theory that even stupid content deserves security, I'd
like to move it to https.  How do I do that?  I got a cert for
*.web.sp.am, but browsers dislike it, saying that the name
in the cert doesn't match the domain name.  I tried to get a
cert for *.*.*.web.sp.am but Let's Encrypt, or at least the
acme.sh client, says multiple wildcards aren't allowed.

Any suggestions?  (Beyond the obvious one to stop wasting my time?)

Tnx,
John

---

From: "John R Levine" <[email-masked]>
Date: 5 Apr 2018 11:47:42 -0400

> The CA/Browser Forum's Baseline Requirements requires that a wildcard
> certificate is one in which the literal '*.' is prepended to a
> fully-qualified domain (that is, that the wildcard character is the
> left-most label).

So I see now.  I wonder what problem that incompatibility with the DNS was 
supposed to solve.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail. https://jl.ly