# Godaddy wildcard certs

**URL:** <https://www.ruby-forum.com/t/godaddy-wildcard-certs/183010>\
**Category:** NGINX\
**Created:** [February 6, 2010, 2:15am UTC](https://www.ruby-forum.com/t/godaddy-wildcard-certs/183010 "2010-02-06T02:15:30Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![wickie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/ba9def/32.png) [@wickie](https://www.ruby-forum.com/u/wickie)\
**Post date:** [February 6, 2010, 2:15am UTC](https://www.ruby-forum.com/t/godaddy-wildcard-certs/183010/1 "2010-02-06T02:15:30Z")

</div>

I’m trying to use a wildcard godaddy cert and having some issues. Once  
I changed the openssl CSR request to have “\*.domain.com” instead of  
“[domain.com](http://domain.com)” now I get an error when trying to start nginx:

failed (SSL: error:0B080074:x509 certificate  
routines:X509\_check\_private\_key:key values mismatch)

Can anyone help?

Here’s the commands…

# openssl genrsa 2048 \> domain.org.key

Generating RSA private key, 2048 bit long modulus  
…+++  
…+++  
e is 65537 (0x10001)

# openssl req -new -key domain.org.key \> domain.org.csr

## You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter ‘.’, the field will be left blank.

Country Name (2 letter code) [GB]:US  
State or Province Name (full name) [Berkshire]:.  
Locality Name (eg, city) [Newbury]:.  
Organization Name (eg, company) [My Company Ltd]:.  
Organizational Unit Name (eg, section) []:.  
Common Name (eg, your name or your server’s hostname) []:\*.domain.org  
Email Address []:removed\_email\_address@domain.invalid

concatenating them all together:

# cat domain.org.crt gd\_bundle.crt \> domain.org.pem

I tried a random hostname… Firefox tells me this:

[wwww3.domain.org](http://wwww3.domain.org) uses an invalid security certificate.

The certificate is only valid for the following names:  
[domain.org](http://domain.org) , [www.domain.org](http://www.domain.org)

(Error code: ssl\_error\_bad\_cert\_domain)

this is my config:

server {  
listen 80;  
listen 10.122.47.104:443 ssl;  
server\_name [domain.org](http://domain.org) \*.domain.org;  
root /home/redirects/web/redirects/domain;  
index index.php;  
location ~ .php$ {  
include /etc/nginx/fastcgi.conf;  
fastcgi\_pass 127.0.0.1:11030;  
}  
ssl\_certificate /etc/nginx/certs/domain.org.crt;  
ssl\_certificate\_key /etc/nginx/certs/domain.org.key;  
ssl\_protocols SSLv3 TLSv1;  
ssl\_ciphers ALL:-ADH:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP;  
rewrite ^ /index.php?url=$host last;  
}

---

<div class="post-metadata">

**Author:** ![wickie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/ba9def/32.png) [@wickie](https://www.ruby-forum.com/u/wickie)\
**Post date:** [February 6, 2010, 4:08am UTC](https://www.ruby-forum.com/t/godaddy-wildcard-certs/183010/2 "2010-02-06T04:08:29Z")

</div>

Sorry I don’t have a lot to add, but I thought it worth mentioning  
that I just bought and configured a GoDaddy wildcard SSL certificate a  
couple weeks ago, and it’s working without any issues. I bought the  
low-end ($199/yr) wildcard cert, in case that matters. I’m running  
nginx-0.8.29.

Here’s my config:

server {  
listen 1.2.3.4:443;  
server\_name \*.domain.com;  
ssl on;  
ssl\_certificate /etc/ssl/certs/any.domain.com.crt;  
ssl\_certificate\_key /etc/ssl/private/any.domain.com.key;  
…  
}

> From what Firefox says, it almost sounds like GoDaddy gave you a  
> non-wildcard cert. (I believe all their non-wildcard certs are valid  
> for both [domain.com](http://domain.com) and [www.domain.com](http://www.domain.com).)

Again, this likely isn’t much help other than knowing that someone  
else has this working.

Nick

---

<div class="post-metadata">

**Author:** ![wickie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/ba9def/32.png) [@wickie](https://www.ruby-forum.com/u/wickie)\
**Post date:** [February 6, 2010, 5:43am UTC](https://www.ruby-forum.com/t/godaddy-wildcard-certs/183010/3 "2010-02-06T05:43:51Z")

</div>

How did you create /etc/ssl/certs/any.domain.com.crt?

Happen to have your openssl commands or whatever you did to generate  
your CSR/etc there?

Thanks, I have the same cert type, it’s nice to know it’s working. Not  
sure why it isn’t for me.

---

<div class="post-metadata">

**Author:** ![wickie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/ba9def/32.png) [@wickie](https://www.ruby-forum.com/u/wickie)\
**Post date:** [February 6, 2010, 6:02am UTC](https://www.ruby-forum.com/t/godaddy-wildcard-certs/183010/4 "2010-02-06T06:02:35Z")

</div>

This article might be of help:

> **[Configuring HTTPS servers](http://nginx.org/en/docs/http/configuring_https_servers.html)**

On 06.02.2010, at 8:00, Mark M. wrote:

> On Fri, Feb 5, 2010 at 8:43 PM, Michael S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:
> 
> > How did you create /etc/ssl/certs/any.domain.com.crt?
> > 
> > Happen to have your openssl commands or whatever you did to generate  
> > your CSR/etc there?
> > 
> > Thanks, I have the same cert type, it’s nice to know it’s working. Not  
> > sure why it isn’t for me.

[…]

Peter.

---

<div class="post-metadata">

**Author:** ![wickie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/ba9def/32.png) [@wickie](https://www.ruby-forum.com/u/wickie)\
**Post date:** [February 6, 2010, 6:07am UTC](https://www.ruby-forum.com/t/godaddy-wildcard-certs/183010/5 "2010-02-06T06:07:51Z")

</div>

On Fri, Feb 5, 2010 at 9:00 PM, Mark M. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> What’s the output of  
> openssl rsa -noout -modulus -in /etc/nginx/certs/domain.org.key  
> and  
> openssl x509 -noout -modulus -in /etc/nginx/certs/domain.org.crt

nope - i redid it multiple times, and just did what you said and it  
came out a match.

also, nginx would barf if the key didn’t match i believe.

---

<div class="post-metadata">

**Author:** ![wickie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/ba9def/32.png) [@wickie](https://www.ruby-forum.com/u/wickie)\
**Post date:** [February 6, 2010, 6:11am UTC](https://www.ruby-forum.com/t/godaddy-wildcard-certs/183010/6 "2010-02-06T06:11:22Z")

</div>

Yeah when connecting I get this:

Verify return code: 19 (self signed certificate in certificate chain)

which is odd; this is the bundle from Godaddy.

[www.domain.org](http://www.domain.org) and [domain.org](http://domain.org) have no issues, if I view the cert it  
shows me “server alternate names” as being both of those - but if I  
try any other aliases it won’t work.

---

<div class="post-metadata">

**Author:** ![wickie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/ba9def/32.png) [@wickie](https://www.ruby-forum.com/u/wickie)\
**Post date:** [February 6, 2010, 6:18am UTC](https://www.ruby-forum.com/t/godaddy-wildcard-certs/183010/7 "2010-02-06T06:18:58Z")

</div>

Here’s the process I used. I believe it is from an article at  
[articles.slicehost.com](http://articles.slicehost.com).

# create private key with password (password to be removed later)

openssl genrsa -des3 -out any.domain.com.key.with-password 2048

# create CSR using key with password and \*.domain.com as Common Name

openssl req -new -key any.domain.com.key.with-password -out  
any.domain.com.csr

# remove password from key

openssl rsa -in any.domain.com.key.with-password -out  
any.domain.com.key

# purchase cert from GoDaddy

# download any.domain.com.crt and gd\_bundle.crt

# add .part to end of any.domain.com.crt filename

# concatenate cert with GoDaddy bundle

cat any.domain.com.crt.part gd\_bundle.crt \> any.domain.com.crt

# copy cert and key to /etc/ssl

cp any.domain.com.crt /etc/ssl/certs/  
cp any.domain.com.key /etc/ssl/private/

Hope that helps.

---

<div class="post-metadata">

**Author:** ![wickie](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/ba9def/32.png) [@wickie](https://www.ruby-forum.com/u/wickie)\
**Post date:** [February 6, 2010, 6:01am UTC](https://www.ruby-forum.com/t/godaddy-wildcard-certs/183010/8 "2010-02-06T06:01:25Z")

</div>

On Fri, Feb 5, 2010 at 8:43 PM, Michael S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> > listen 1.2.3.4:443;
> > 
> > > “[domain.com](http://domain.com)” now I get an error when trying to start nginx:
> > > 
> > > # openssl genrsa 2048 \> domain.org.key
> > > 
> > > For some fields there will be a default value,
> > > 
> > > [domain.org](http://domain.org) , [www.domain.org](http://www.domain.org)  
> > > root /home/redirects/web/redirects/domain;  
> > > index index.php;  
> > > location ~ .php$ {  
> > > include /etc/nginx/fastcgi.conf;  
> > > fastcgi\_pass 127.0.0.1:11030;  
> > > }  
> > > ssl\_certificate /etc/nginx/certs/domain.org.crt;  
> > > ssl\_certificate\_key /etc/nginx/certs/domain.org.key;  
> > > ssl\_protocols SSLv3 TLSv1;  
> > > ssl\_ciphers ALL:-ADH:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP;  
> > > rewrite ^ /index.php?url=$host last;

That error sounds like it’s trying to use a key that’s not the same  
key you generated the csr with.

What’s the output of  
openssl rsa -noout -modulus -in /etc/nginx/certs/domain.org.key  
and  
openssl x509 -noout -modulus -in /etc/nginx/certs/domain.org.crt  
?