Hello William,
Thanks for your valuable information. For SubjectAlternativeNames, the alternative names
you have shown in the example contains '-' symbol, like
'nss-alt.dev.example.com'. Is '-' symbol required in the server's
hostname? Since we don't use that hostname naming convention. We use something like
'nssdev1.example.com', 'nssdev2.example.com'. So if I purchase
'nssdev.example.com' SubjectAlternativeNames, would it work for
'nssdev1.example.com' and 'nssdev2.example.com'?
- xinhuan
From: William Brown <wibrown(a)redhat.com>
To: General discussion list for the 389 Directory server project.
<389-users(a)lists.fedoraproject.org>
Sent: Sunday, June 12, 2016 5:22 PM
Subject: [389-users] Re: 389 directory server wildcard certificate
On Sun, 2016-06-12 at 16:39 +0000, xinhuan zheng wrote:
I need to deploy multiple 389 directory server instances into
production environment. I want to know if 389 directory server
supports wildcard server certificate. Currently the subject for my instance is:
Subject: "CN=dmdev1.christianbook.com,OU=389 Directory Server"
When using wildcard, it will be:
Subject: "CN=*.christianbook.com,OU=389 Directory Server"
Yes.
Is it possible?
I guess GoDaddy might be able to support wildcard certificate but I am not sure. Does
anyone know about it?
No sorry. Wild cards cost a lot.
I would recommend a better approach. NSS supports SAN (SubjectAltenativeNames) on certs.
So you make a cert with:
certutil -R -f pwdfile.txt -d . -t "C,," -x -n "Server-Cert" -g 2048\
-s "CN=nss.dev.example.com,O=Testing,L=example,ST=Queensland,C=AU" \
-8 "nss.dev.example.com,nss-alt.dev.example.com" -o nss.dev.example.com.csr
This certificate once signed would be useable with:
*
nss.dev.example.com
*
nss-alt.dev.example.com
There's no real limit to how many alternative names you can have, but it's a good
idea to plan your deployment so you don't have
to keep re-issuing these when you request more certs.
Remember, this still needs signing so you would need to send the .csr to your CA
I hope that helps you,
Thanks,
- xinhuan
--
389-users mailing list
389-users(a)lists.fedoraproject.org
https://lists.fedoraproject.org/admin/lists/389-users@lists.fedoraproject...
--
Sincerely,
William Brown
Software Engineer
Red Hat, Brisbane
--
389-users mailing list
389-users(a)lists.fedoraproject.org
https://lists.fedoraproject.org/admin/lists/389-users@lists.fedoraproject...