Sslip.io: A Valid SSL Certificate for Every IP Address

Re:Sslip.io: A Valid SSL Certificate for Every IP Address by jgrahamc on Tuesday September 08, 2015 @12:43PM (#10186745)

    *.example.com won't match foo.bar.example.com.

That's a technical limitation of the way name matching works (similar to DNS); not a CloudFlare restriction.

Our free Universal SSL certificate includes a wildcard (so if you sign up example.com you get *.example.com).

[ Parent | on HN ]

Re:Sslip.io: A Valid SSL Certificate for Every IP Address by fanf2 on Wednesday September 09, 2015 @06:25AM (#10190640)

Annoyingly, TLS wildcards have very a different meaning to DNS wildcards.

DNS wildcards only work when * is the leftmost label of a domain name, so

    *.example.com is a wildcard
    foo.*.example.com is not a wildcard
    *bar.example.com is not a wildcard

A DNS wildcard matches any non-zero number of labels, so

    *.example.com
    foo.example.com matches
    foo.bar.example.com matches
    example.com does not match

RFC 4592 describes DNS wildcards.

Unlike the DNS, the * in a TLS certificate can only match one label, so

    *.example.com
    foo.example.com matches
    foo.bar.example.com does NOT match
    example.com does not match

RFC 2818 also allows the * to appear within a domain name, not just as the leftmost label, and wildcards work even when they are part of a label. One of its examples says

    f*.com
    foo.com matches
    bar.com does not match

But nowadays sub-label wildcards like this are not supported.

[ Parent | on HN ]

Re:Sslip.io: A Valid SSL Certificate for Every IP Address by MichaelGG on Tuesday September 08, 2015 @04:39PM (#10188092)

Right, but even in paid plans, there's no ability to get further subdomains. Just pointing that out and wondering why. Technical issue that isn't worth the effort?

[ Parent | on HN ]