How the does YouTube SSL certificate work, it says *.google.com

Question

I was just wondering how the YouTube SSL certificate works because it says it was issued to *.google.com.

I thought wildcard SSL certificates would only work with sub domains?

Thanks in advance, Francis

Answer 1

The Common Name (CN) in the certificate is only used when no DNS Subject Alternative Names are present (see RFC 2818 Section 3.1). When SANs are present, any of them is good for identifying the server. The certificate use by YouTube has all of these:

DNS Name: *.google.com
DNS Name: *.android.com
DNS Name: *.appengine.google.com
DNS Name: *.cloud.google.com
DNS Name: *.google-analytics.com
DNS Name: *.google.ca
DNS Name: *.google.cl
DNS Name: *.google.co.in
DNS Name: *.google.co.jp
DNS Name: *.google.co.uk
DNS Name: *.google.com.ar
DNS Name: *.google.com.au
DNS Name: *.google.com.br
DNS Name: *.google.com.co
DNS Name: *.google.com.mx
DNS Name: *.google.com.tr
DNS Name: *.google.com.vn
DNS Name: *.google.de
DNS Name: *.google.es
DNS Name: *.google.fr
DNS Name: *.google.hu
DNS Name: *.google.it
DNS Name: *.google.nl
DNS Name: *.google.pl
DNS Name: *.google.pt
DNS Name: *.googleapis.cn
DNS Name: *.googlecommerce.com
DNS Name: *.gstatic.com
DNS Name: *.urchin.com
DNS Name: *.url.google.com
DNS Name: *.youtube-nocookie.com
DNS Name: *.youtube.com
DNS Name: *.youtubeeducation.com
DNS Name: *.ytimg.com
DNS Name: android.com
DNS Name: g.co
DNS Name: goo.gl
DNS Name: google-analytics.com
DNS Name: google.com
DNS Name: googlecommerce.com
DNS Name: urchin.com
DNS Name: youtu.be
DNS Name: youtube.com
DNS Name: youtubeeducation.com