Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

Accepted wildcards used by server certificates for server authentication

View products that this article applies to.


Implementation of SSL/TLS in the SCHANNEL security provider allows for the use of wildcard characters in server certificates in all operating systems except in Microsoft Windows 2000 with service packs installed. When you install Windows 2000 Service Pack 1 or later, this functionality is already present.

↑ Back to the top

More information

When SCHANNEL is used to authenticate a server during an HTTPS session, the server presents a certificate. This certificate has a common name that is compared against the server name extracted from the remote resource request. For example, if you point your browser to, SCHANNEL ensures that the server presents a certificate with the common name; otherwise it informs the application that the server authentication failed.

A variation on this certificate-matching scheme has been documented in RFC 2595 and draft RFC specs for other protocols. This functionality allows the server certificate to have a wildcard (*) in the common name (CN). With the wildcard, you may have a single certificate (or only one CN in the certificate) installed on a group of servers with somewhat similar names. The implementation is designed so that multiple servers are given duplicates of the same wildcarded certificate that authenticates a set of servers. For instance, a company may have three SSL e-commerce servers with the following names:
For this example, the company may buy a single certificate containing the name *

The following are some examples of how wildcards should and should not be used for maximum interoperability.

Accepted wildcard examples

  • matches
  • * matches
  • w* matches
  • ww* matches
  • matches www.examPle.cOm

Nonaccepted wildcard examples

  • *
  • *
  • w*
  • * does not match
  • www.e* does not match
  • www.* does not match
  • www.ex*.com does not match
  • www.*.com does not match
  • does not match *.com does not match
  • does not match *
  • does not match *.*
  • example does not match *
  • does not match a*.d*
  • does not match *.*
  • does not match www.*

↑ Back to the top

Applies to:

↑ Back to the top

Keywords: kbenv, kbinfo, KB258858

↑ Back to the top

Article Info
Article ID : 258858
Revision : 8
Created on : 1/22/2010
Published on : 1/22/2010
Exists online : False
Views : 679