Using multiple wildcard certificates with "Protecting SSL server"
The documentation states you can define multiple certificates in an SSL profile in replace mode and it will compare the server name identification (SNI) and the common name (CN) with the certificate list in the SSL profile, and use the matched certificate as a replacement. If there is no matched server certificate in the list, then the first server certificate in the list is used as a replacement.
However, this does not seem to work if you are using wildcard certificates. I have an SSL profile that has multiple separate wildcard certificates defined in the profile that is used to protect a highly available reverse proxy for several domains and subdomains.
e.g. SSL Profile in replace mode has separate wildcard certificates for *.abc.net, *.abc.com, *.io.abc.com, *.abc.org, *.bbc.com, *.bbc.org.Â
If a request comes in with an SNI of www.abc.com it will instead return the first certificate *.abc.net as the exact CN name matching does not match the wildcard.
Has anyone else experienced this issue or know of a way to make it work? The only way we have found is to create a single certificate that has all the wildcards in it, but this can also cause info disclosure of the hosts on the IP and if they are for different organisations it can be difficult getting all the wildcards in the one cert.
Thanks.