# Wildcard names incomplete? **URL:** \ **Category:** Issuance Tech\ **Created:** [March 1, 2018, 2:22pm UTC](https://community.letsencrypt.org/t/wildcard-names-incomplete/54525 "2018-03-01T14:22:50Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![badfiles](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/badfiles/32/20853_2.png) [@badfiles](https://community.letsencrypt.org/u/badfiles)\ **Post date:** [March 1, 2018, 2:22pm UTC](https://community.letsencrypt.org/t/wildcard-names-incomplete/54525/1 "2018-03-01T14:22:50Z")
Are you sure the wildcard cert for > CN=\*.domain.example should be with only one > X509v3 Subject Alternative Name: > DNS:\*.domain.example and not be complete to cover the root domain itself like this: > X509v3 Subject Alternative Name: > DNS:\*.domain.example > DNS:domain.example I'm afraid certs with only one alternative name `DNS:*.domain.example` will not work for > [https://domain.example](https://domain.example) The staging v2 issues incomplete wildcard certs in my opinion, will you fix this in production? ---
**Author:** ![bytecamp](https://avatars.discourse-cdn.com/v4/letter/b/54ee81/32.png) [@bytecamp](https://community.letsencrypt.org/u/bytecamp)\ **Post date:** [March 1, 2018, 2:29pm UTC](https://community.letsencrypt.org/t/wildcard-names-incomplete/54525/2 "2018-03-01T14:29:26Z")
> [@ACMEv2 and Wildcard Launch Delay](https://community.letsencrypt.org/t/acmev2-and-wildcard-launch-delay/53654/40): > > The staging v2 issues incomplete wildcard certs in my opinion, will you fix this in production? Its up to the client to setup the SAN list in the CSR. If you only request a certificate for \*.example.com without adding [example.com](http://example.com) to the SANs, it's most probably your fault. ---
**Author:** ![badfiles](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/badfiles/32/20853_2.png) [@badfiles](https://community.letsencrypt.org/u/badfiles)\ **Post date:** [March 1, 2018, 2:34pm UTC](https://community.letsencrypt.org/t/wildcard-names-incomplete/54525/3 "2018-03-01T14:34:07Z")
> [@ACMEv2 and Wildcard Launch Delay](https://community.letsencrypt.org/t/acmev2-and-wildcard-launch-delay/53654/41): > > Its up to the client to setup the SAN list in the CSR. If you only request a certificate for \*.example.com without adding [example.com](http://example.com) to the SANs, it’s most probably your fault. You'll get one challenge and this "type": "urn:ietf:params:acme:error:unauthorized", "detail": "Error finalizing order :: Order includes different number of names than CSR specifies", "status": 403 for csr with both domain itself and \*. for subdomains. ---
**Author:** ![cpu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/cpu/32/84514_2.png) [@cpu](https://community.letsencrypt.org/u/cpu)\ **Post date:** [March 1, 2018, 2:36pm UTC](https://community.letsencrypt.org/t/wildcard-names-incomplete/54525/4 "2018-03-01T14:36:18Z")
> [@badfiles](#): > > You’ll get one challenge and this > > "type": “urn:ietf:params:acme:error:unauthorized”, > > “detail”: “Error finalizing order :: Order includes different number of names than CSR specifies”, > > “status”: 403 > > for csr with both domain itself and \*. for subdomains. You need to submit the same identifiers that you intend to use in the finalization CSR in your initial `newOrder` request. edit: To clarify what's already been said: this isn't a bug in our Wildcard implementation. ---
**Author:** ![tdelmas](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/tdelmas/32/1866_2.png) [@tdelmas](https://community.letsencrypt.org/u/tdelmas)\ **Post date:** [March 1, 2018, 2:36pm UTC](https://community.letsencrypt.org/t/wildcard-names-incomplete/54525/5 "2018-03-01T14:36:11Z")
> [@ACMEv2 and Wildcard Launch Delay](https://community.letsencrypt.org/t/acmev2-and-wildcard-launch-delay/53654/40): > > The staging v2 issues incomplete wildcard certs in my opinion If you have a server that handle request for \* .example.com and another for [example.com](http://example.com) it may create some security issues if you can't have a certificate valid only for "\*.example.com". ---
**Author:** ![tlussnig](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/tlussnig/32/2053_2.png) [@tlussnig](https://community.letsencrypt.org/u/tlussnig)\ **Post date:** [March 1, 2018, 2:36pm UTC](https://community.letsencrypt.org/t/wildcard-names-incomplete/54525/6 "2018-03-01T14:36:57Z")
I think this is not an bug but an feature that shows another point why the challange for wildcard and domain should be different. For example and company have an Hosting Location where customerXY.domain is hosted on one server and another location with only domain for the company representation and they maybe like to separate this two certificates. But it should be mentioned prominently that often both names should be included. So that it over more flexibility to the users. ---
**Author:** ![badfiles](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/badfiles/32/20853_2.png) [@badfiles](https://community.letsencrypt.org/u/badfiles)\ **Post date:** [March 1, 2018, 2:49pm UTC](https://community.letsencrypt.org/t/wildcard-names-incomplete/54525/7 "2018-03-01T14:49:22Z")
Thank you guys, I got the point. I successfully received the cert for \*.domain.example and domain.example using a .csr with cn=domain.example and both > X509v3 Subject Alternative Name: > DNS:domain.example, DNS:\*.domain.example ``` # INFO: Using main config file /etc/dehydrated/config + Requesting new certificate order from CA... + Received 2 authorizations URLs from the CA + Handling authorization for domain.example + Found valid authorization for domain.example + Handling authorization for domain.example + Found valid authorization for domain.example + 0 pending challenge(s) + Requesting certificate... + Checking certificate... + Done! ``` ---
**Author:** ![cpu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/cpu/32/84514_2.png) [@cpu](https://community.letsencrypt.org/u/cpu)\ **Post date:** [March 1, 2018, 2:50pm UTC](https://community.letsencrypt.org/t/wildcard-names-incomplete/54525/8 "2018-03-01T14:50:42Z")
A post was split to a new topic: [Wildcard issuance: two TXT records for the same name](https://community.letsencrypt.org/t/wildcard-issuance-two-txt-records-for-the-same-name/54528) ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [March 31, 2018, 2:50pm UTC](https://community.letsencrypt.org/t/wildcard-names-incomplete/54525/9 "2018-03-31T14:50:42Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.