TLS confusion - new subdomain for existing service

This is probably something obvious, but I’m not sure how to fix it.

I have an existing VCL, with the domain plfpl-rt-test.staging.our.domain; all is fine with this. The dns is handled by route 53 and there’s a cname for n.sni.global.fastly.net. We have a Fastly managed wildcarded certificate for *.staging.our.domain

I’ve recently added an additional domain api.plfpl-rt-test.staging.our.domain to the same service and created the corresponding cname record in route53.

However when make requests for the new api. subdomain the certificate that’s used is for n.sni-347-default.ssl.fastly.net, not our wildcarded certificate.

Given that it works without the api. subdomain, what do I need to do to fix it when using the subdomain?

1 Like

Nevermind - I’d forgotten that wildcard certificates only work for immediate subdomains.

1 Like