Target:

Generate a single SSL Certificate thats valid for

• domain1.com
• *.domain1.com
• domain2.com
• *.domain2.com

Let it be self signed or a locally-generated CA signed.

Scenario 1

# ssl.conf

[ req ]
default_bits        = 1024
default_keyfile     = server.key
distinguished_name  = req_distinguished_name
req_extensions     = req_ext # The extentions to add to the self signed cert

[ req_distinguished_name ]
countryName           = Country Name (2 letter code)
countryName_default   = US
stateOrProvinceName     = State or Province Name (full name)
stateOrProvinceName_default = Connecticut
localityName            = Locality Name (eg, city)
localityName_default    = Stamford
organizationName        = Organization Name (eg, company)
organizationName_default    = Example, Inc.
commonName            = Common Name (eg, YOUR name)
commonName_max        = 64

[ req_ext ]
subjectAltName          = @alt_names

[alt_names]
DNS.1   = *.domain1.com
DNS.2   = *.domain2.com

CN entered during csr generation:

*.domain1.com

Firefox Error on domain2.com

domain2.com uses an invalid security certificate.

The certificate is not trusted because it is self-signed.
The certificate is only valid for *.domain1.com

(Error code: sec_error_untrusted_issuer)

SSL Cert in plain text:

Certificate:
    Data:
        Version: 1 (0x0)
        Serial Number:
            e9:59:8a:31:8e:29:df:bf
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, ST=Connecticut, L=Stamford, O=Example, Inc., CN=*.domain1.com
        Validity
            Not Before: Oct 27 06:18:28 2010 GMT
            Not After : Oct 24 06:18:28 2020 GMT
        Subject: C=US, ST=Connecticut, L=Stamford, O=Example, Inc., CN=*.domain1.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (1024 bit)
                Modulus (1024 bit):
                    00:c9:9c:50:52:be:35:64:98:7a:b9:49:8a:f3:f0:
                    af:52:62:49:2f:d3:a1:a3:d7:78:b1:88:14:e9:b2:
                    52:f1:2a:04:71:76:14:a3:17:d8:15:61:da:de:50:
                    5b:dd:66:74:12:8d:d6:6b:15:94:35:20:7b:cf:e7:
                    32:31:33:d5:f5:b9:12:a5:dc:a6:7d:08:1f:c9:f6:
                    9f:35:4d:46:1d:a0:a9:6e:90:35:0f:21:7d:76:d2:
                    96:41:7c:c9:4a:fd:9d:81:be:89:f6:f4:70:eb:52:
                    56:5d:0c:d5:62:2b:d5:fc:7f:21:0a:9c:e9:19:d5:
                    ad:dc:6b:2b:12:3e:47:3a:ed
                Exponent: 65537 (0x10001)
    Signature Algorithm: sha1WithRSAEncryption
        a1:1f:4f:85:ae:82:52:d0:7e:47:59:fb:d2:17:5c:04:2a:a9:
        28:82:84:71:70:41:8d:61:51:3d:89:a9:0c:b3:a2:fd:f9:ff:
        c6:e4:aa:3a:5b:0f:c5:17:f3:62:4a:78:78:10:bf:45:e6:f4:
        f3:43:3b:dc:26:fd:86:17:fc:f5:e2:1a:ee:fe:76:6e:59:7f:
        b1:38:ad:d8:6d:8e:23:55:39:bc:47:20:c9:a0:f4:db:64:ed:
        5b:b2:bf:44:a6:a9:82:fb:76:b9:87:6c:92:07:42:f6:a3:00:
        c1:58:86:b2:2b:0e:6f:f1:74:4a:08:6f:37:80:02:65:4b:e5:
        0d:a9

Scenario 2:

[ req ]
default_bits        = 1024
default_keyfile     = server.key
distinguished_name  = req_distinguished_name

[ req_distinguished_name ]
countryName           = Country Name (2 letter code)
countryName_default   = US
stateOrProvinceName     = State or Province Name (full name)
stateOrProvinceName_default = Connecticut
localityName            = Locality Name (eg, city)
localityName_default    = Stamford
organizationName        = Organization Name (eg, company)
organizationName_default    = Example, Inc.
0.commonName            = Common Name (eg, YOUR name)
0.commonName_default    = *.domain1.com
0.commonName_max        = 64
1.commonName            = Common Name (eg, YOUR name)
1.commonName_default    = *.domain2.com
1.commonName_max        = 64

FirefoxOutput in this case:

domain1.com uses an invalid security certificate.

The certificate is not trusted because it is self-signed.
The certificate is only valid for *.domain2.com

Plain Text SSL Cert output:

Certificate:
    Data:
        Version: 1 (0x0)
        Serial Number:
            80:b5:78:8a:27:0e:e5:b8
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, ST=Connecticut, L=Stamford, O=Example, Inc., CN=*.domain1.com, CN=*.domain2.com
        Validity
            Not Before: Oct 27 06:05:40 2010 GMT
            Not After : Oct 24 06:05:40 2020 GMT
        Subject: C=US, ST=Connecticut, L=Stamford, O=Example, Inc., CN=*.domain1.com, CN=*.domain2.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (1024 bit)
                Modulus (1024 bit):
                    00:e8:f6:a6:ef:a7:68:cd:5d:99:d8:5a:7d:9e:23:
                    4e:9f:67:f8:e0:20:8a:5c:ad:5f:1f:71:63:66:cf:
                    34:7d:c8:21:86:65:3b:07:ed:27:4c:f8:55:08:7e:
                    67:5e:c3:e9:53:0c:44:3f:1f:e8:f9:85:24:6e:60:
                    c6:98:b4:f0:13:85:46:23:c3:bf:ec:3c:5b:0d:cb:
                    bd:8a:67:c3:a6:fe:d2:27:de:38:60:23:fd:12:9d:
                    95:1a:38:c6:bc:81:57:bb:c1:1a:60:1a:79:c9:f1:
                    d9:e4:a0:2d:a1:6e:c6:12:e7:2a:e2:76:d7:56:89:
                    a9:77:ce:7e:d1:d6:b8:28:1b
                Exponent: 65537 (0x10001)
    Signature Algorithm: sha1WithRSAEncryption
        41:82:a7:c1:f2:11:e6:04:a8:7b:58:3c:47:ac:af:d9:46:48:
        87:24:c4:f2:fe:94:94:5f:6c:54:17:51:26:73:0b:fb:97:74:
        82:47:1d:7f:b8:63:ca:6c:49:e6:36:86:bf:7d:60:7a:74:c0:
        41:43:2a:35:7a:67:11:2b:cc:91:4e:5e:d4:23:9e:2b:a7:ad:
        35:af:90:82:7e:33:ac:36:f7:c4:46:fc:81:55:f4:3f:75:04:
        67:07:cb:8f:2b:3c:07:c0:a2:61:bc:f1:aa:fe:b3:26:c9:dc:
        a1:a1:6a:e6:81:95:1f:a9:36:33:bb:b0:04:45:69:cf:51:9d:
        8d:45

Vhosts

<VirtualHost 127.0.1.3:443>
        ServerName domain1.com
        ServerAlias www.domain1.com
        ServerAlias www1.domain1.com
        ServerAlias www2.domain1.com
        ServerAdmin webmaster@domain1.com
        DocumentRoot /var/www/ssltest/domain1/


        SSLEngine on
        SSLCertificateFile /etc/apache2/ssl-files/server.crt
        SSLCertificateKeyFile /etc/apache2/ssl-files/server.key


        ErrorLog /var/log/apache2/domain1.com-error_log
        CustomLog /var/log/apache2/domain1.com-access_log common


</VirtualHost>


<VirtualHost 127.0.1.2:443>
        ServerName domain2.com
        ServerAlias www.domain2.com
        ServerAlias www1.domain2.com
        ServerAlias www2.domain2.com
        ServerAdmin webmaster@domain2.com
        DocumentRoot /var/www/ssltest/domain2/


        SSLEngine on
        SSLCertificateFile /etc/apache2/ssl-files/server.crt
        SSLCertificateKeyFile /etc/apache2/ssl-files/server.key


        ErrorLog /var/log/apache2/domain2.com-error_log
        CustomLog /var/log/apache2/domain2.com-access_log common


</VirtualHost>

Also in each Scenario, Firefox complains:

domain1.com uses an invalid security certificate.

The certificate is not trusted because it is self-signed.
The certificate is only valid for *.domain1.com

(Error code: sec_error_untrusted_issuer)

if i visit https://domain1.com instead of those ServerAliases inside vhost config