Claims Auth, ADFS & Subject Alternate names

Question

I currently have a wildcard cert *name.com with several subject alternate names. Inside the subject alternate names, there is an entry for name.net and several other variations.

The URL of my SharePoint 2010 site is name.net and because of that I am hearing that my wildcard cert is not valid and I need a wildcard cert for *name.net.

Does that mean that subject alternate names are not valid for ADFS/Claims/SP2010 configuration?

During my research I found this article: http://blogs.technet.com/b/adfs/archive/2007/07/23/adfs-certificates-ssl-token-signing-and-client-authentication-certs.aspx

It clearly says: The Subject Name of the SSL certificate must match the names used in the ADFS configuration. For example, if you specify a federation server endpoint URL as https://adfsresource.treyresearch.net/adfs/ls/ - then the subject name on the SSL certificate for that server must be “adfsresource.treyresearch.net” This is a very important item and a common misconfiguration.

I didn't see any mention of subject alternate names and if they are valid.

Even more interesting is that my symptoms match up perfectly to the blog post...no errors in my logs. (so please don't respond with instructions for enabling error logs in ADFS, I've already done that)

Could someone please shed some light on this? Are there any articles that I skipped over?

Answer 1

So you're saying you've got name.net as well as name.com as SANs within your certificate?

For your canonical names you need *.name.net as a subject alternative name if you wish to use an unlimited number of canonical names.

ADFS fully supports wildcard certificates if you create them with valid subject alternative names.