Self-signed certificate: DNSName components must begin with a letter

java certificate keytool self-signed wildcard-subdomain
zkristic picture zkristic · Nov 20, 2015 · Viewed 11.7k times · Source

Is there a way for java's keytool to generate self-signed certificate with a wildcard in SAN (Subject Alternative Name)? I'm using this command to generate keystore:

keytool -genkey -alias tomcat -storetype JKS -keyalg RSA -keysize 2048 -ext san=dns:*.example.com -keystore "path/to/my/keystore.jks" -validity 3650

But I get IOException: DNSName components must begin with a letter

Obviously, the problem is *.example.com in SAN, but I don't see other way of generating self-signed certificate for example.com subdomains.

According to this, it should be possible. Is it error in my syntax, bug in keytool, or I misunderstood something?

BTW, I'm using keytool from JDK 1.8 update 60

EDIT I managed to generate self-signed certificate for all example.com subdomains via keytool by specifying CN=*.example.com, and leaving SAN empty. Nonetheless, I'll leave Omikron's answer as accepted (since it's an actual answer and not a bypass of restrictions).

Answer

Omikron picture Omikron · Nov 21, 2015

Keytool internally uses the class sun.security.x509.DNSName to check the input. DNSName enforces the syntax specified in RFC 1034. Quote from its Javadoc comment:

The name MUST be in the "preferred name syntax," as specified by RFC 1034.

The preferred name syntax is:

<domain> ::= <subdomain> | " "
<subdomain> ::= <label> | <subdomain> "." <label>
<label> ::= <letter> [ [ <ldh-str> ] <let-dig> ]
<ldh-str> ::= <let-dig-hyp> | <let-dig-hyp> <ldh-str>
<let-dig-hyp> ::= <let-dig> | "-"
<let-dig> ::= <letter> | <digit>
<letter> ::= any one of the 52 alphabetic characters A through Z in
upper case and a through z in lower case
<digit> ::= any one of the ten digits 0 through 9

So according to this syntax, domain names have to begin with a letter (A-Z, a-z).

Newer RFCs (e.g. RFC 2181, RFC 1123) are relaxing these restrictions, so this can be considered a bug in Java. There are already several related bug reports:

https://bugs.openjdk.java.net/browse/JDK-8016345
https://bugs.openjdk.java.net/browse/JDK-8007706

So, the answer is no, there is currently no way to create a wildcard SAN extension with keytool.

But you could use KeyStore Explorer to do this. It is basically keytool with a GUI and does not enforce these restrictions.

UPDATE: This has been fixed in Java 15: https://bugs.openjdk.java.net/browse/JDK-8186143

Related questions

How to generate, sign and import SSL certificate from Java

Possible Duplicate: Generate certificates, public and private keys with Java I need to generate a self signed certificates at run time, sign them and import to the Java keystore. I can do this using "keytool" and "openssl" from command line …

Read More
How to properly import a selfsigned certificate into Java keystore that is available to all Java applications by default?

I do want to import a self signed certificate into Java so any Java application that will try to establish a SSL connection will trust this certificate. So far, I managed to import it in keytool -import -trustcacerts -noprompt -storepass …

Read More
How to convert .pfx file to keystore with private key?

I need to sign Android application (.apk). I have .pfx file. I converted it to .cer file via Internet Explorer and then converted .cer to .keystore using keytool. Then I've tried to sign .apk with jarsigner but it says that .…

Read More