FTPs: wildcard SSL certificates

knyar · Post by *knyar » 2006-12-23, 17:43 UTC

Hi!

First of all, I would like to say thanks for implementing FTPs support in Total Commander - this really is a great and long-awaited feature.

The issue I would like to address is wildcard certificates. It is a common practice for a company owning a domain name, say, example.tld to purchase a certificate with CN equal to *.example.tld and to use this certificate for all hosts needing SSL support (both aaa.example.tld and bbb.example.tld will usually match such certificate).

As I can see, Total Commander shows "red lock" when a wildcard certificate is used. I have a certificate *.xxx.zzz.tld and Total Commander says the certificate is incorrect for both ftpserver.xxx.zzz.tld and xxx.zzz.tld (even though xxx.zzz.tld is not strictly matching *.xxx.zzz.tld wildcard, most of software usually considers such situation normal).

Post by *ghisler(Author) » 2006-12-26, 17:19 UTC

Thanks for your suggestion.

What error is shown when you click on the lock?

knyar · Post by *knyar » 2007-01-10, 09:47 UTC

The error is:
The presented server certificate seems to belong to a different server name!

Connected to: db.spirit.blahblah.tld
Validity: 2006-12-21 13:57:34 until 2008-12:20 13:57:34

Cert subject:
Common name: *.spirit.blahblah.tld

Cert issuer:
[skipped]

Post by *ghisler(Author) » 2007-01-10, 09:54 UTC

Thanks for the info! It should be no problem to add this.
I have one more question: Does the cert for *.spirit.blahblah.tld also cover the domain spirit.blahblah.tld, or only the subdomains?

Post by *ghisler(Author) » 2007-01-16, 17:05 UTC

Could you please try whether wildcard certificates work now, please?

What about my question about the subdomains?

Post by *ghisler(Author) » 2007-01-28, 17:14 UTC

BUMP
Anyone can confirm that it works with wildcard certificates now, please?

Post by *ghisler(Author) » 2007-04-03, 14:48 UTC

BUMP BUMP BUM BUMP

Anyone having a server with a wildcard certificate, please?

franck8244 · Post by *franck8244 » 2007-05-02, 22:15 UTC

I have created a self-signed certificate :
*.toto.net -> accept it (always trust...) -> no more message : OK

then a connection to truename.toto.net -> no message : certificate is validated

(A self-signed certificate with an expired date can note be validated (no accept it button) )

Post by *ghisler(Author) » 2007-05-03, 15:55 UTC

I have created a self-signed certificate :
*.toto.net -> accept it (always trust...) -> no more message : OK

then a connection to truename.toto.net -> no message : certificate is validated

Great, thanks for testing it!

A self-signed certificate with an expired date can note be validated (no accept it button)

Yes, this is intentional. The same is true for invalid or unsigned certificates (see this thread).