# ACME v2 - Wildcard Requests and SANs?

**URL:** <https://community.letsencrypt.org/t/acme-v2-wildcard-requests-and-sans/51262>\
**Category:** Issuance Tech\
**Created:** [January 24, 2018, 6:28am UTC](https://community.letsencrypt.org/t/acme-v2-wildcard-requests-and-sans/51262 "2018-01-24T06:28:56Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![webprofusion](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/webprofusion/32/85310_2.png) [@webprofusion](https://community.letsencrypt.org/u/webprofusion)\
**Post date:** [January 24, 2018, 6:28am UTC](https://community.letsencrypt.org/t/acme-v2-wildcard-requests-and-sans/51262/1 "2018-01-24T06:28:56Z")

</div>

Quick question to anybody who knows such things:

Should the Subject Alternative Names of the CSR include the wildcard domain (e.g. \*.test.com)? Currently CN=\*[test.com](http://test.com) is enough for the order to finalize but including \*.test.com in the SAN list results in an error from the API (CSR contains domains not in Order).

---

<div class="post-metadata">

**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\
**Post date:** [January 24, 2018, 6:44am UTC](https://community.letsencrypt.org/t/acme-v2-wildcard-requests-and-sans/51262/2 "2018-01-24T06:44:57Z")

</div>

The CSR should contain the same names as there are DNS identifiers in the order.

---

<div class="post-metadata">

**Author:** ![webprofusion](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/webprofusion/32/85310_2.png) [@webprofusion](https://community.letsencrypt.org/u/webprofusion)\
**Post date:** [January 24, 2018, 6:54am UTC](https://community.letsencrypt.org/t/acme-v2-wildcard-requests-and-sans/51262/3 "2018-01-24T06:54:40Z")

</div>

Technically it does contain the DNS identifier because the wildcard domain is included as subject name. Maybe the SAN list should include [test.com](http://test.com) if the subject name is \*.test.com (but SAN list should not contain \*.test.com?)

---

<div class="post-metadata">

**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\
**Post date:** [January 24, 2018, 7:06am UTC](https://community.letsencrypt.org/t/acme-v2-wildcard-requests-and-sans/51262/4 "2018-01-24T07:06:38Z")

</div>

Going by a v2 implementation I know is working, including `*.test.com` as both the Subject (CN=) and a SAN DNS Name should work:

[https://github.com/eggsampler/acme/blob/master/example/certbot.go#L172-L178](https://github.com/eggsampler/acme/blob/master/example/certbot.go#L172-L178)

The spec says

> The CSR MUST indicate the exact same  
> set of requested identifiers as the initial new-order request, either  
> in the commonName portion of the requested subject name, or in an  
> extensionRequest attribute [RFC2985] requesting a subjectAltName  
> extension

So if your `new-order` was

`"identifiers": [{"type:"dns","value":"*.test.com"}]`

then a CSR that includes `*.test.com` as both the `subject` and `subjAltName` should work just fine.

Can you show an order and CSR pair that is failing, as well as any error message?

---

<div class="post-metadata">

**Author:** ![webprofusion](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/webprofusion/32/85310_2.png) [@webprofusion](https://community.letsencrypt.org/u/webprofusion)\
**Post date:** [January 24, 2018, 7:12am UTC](https://community.letsencrypt.org/t/acme-v2-wildcard-requests-and-sans/51262/5 "2018-01-24T07:12:56Z")

</div>

Thanks, found the problem!

I was adding the dns identifiers that we get back from authorization into the SAN list, turns out they get stripped of the \*. prefix so I was actually just adding [test.com](http://test.com) instead of \*.test.com (which caused the error), what confused me was that it worked fine when I left the SAN list blank and just set the subject name.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [February 23, 2018, 7:13am UTC](https://community.letsencrypt.org/t/acme-v2-wildcard-requests-and-sans/51262/6 "2018-02-23T07:13:03Z")

</div>

Closed on February 23, 2018, 7:13am UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.