Wildcard proxy SSL issue

[vaibhav.kurde]

Recently Cloudflare has opened the wildcard proxy support to free accounts too. LINK HERE
But I couldn’t understand, how SSL certificates will be managed for it??
Suppose, I have configured domain example.com with cf. I have got SSL cert from cf with wildcard which will be valid only for following domains
example.com
*.example.com

As per the new offering, if I configure new wildcard proxy, say sub1.sub2.example.com , then following entries must be reflected in cf ssl certificate
example.com
*.example.com
sub1.sub2.example.com
*.sub1.sub2.example.com

But this is not happening. I am getting only first 2 SANs in certificate. Then how this offering is usable to free users without the inclusion of all added wildcards added into dns list?
Am I interpreting the offering wrong?

[KianNH]

@vaibhav.kurde

Am I interpreting the offering wrong?

Yes. Nothing has changed in regards to subdomains that are two levels deep, that was never related to if you could proxy a wildcard or not.

You need Advanced Certificate Manager for a certificate that covers *.sub2.example.com

Subdomain too deep

This tutorial covers a possible reason for the SSL_ERROR_NO_CYPHER_OVERLAP and ERR_SSL_VERSION_OR_CIPHER_MISMATCH errors (Firefox and Chrome respectively) when seen on a subdomain. The Cloudflare universal certificates cover example.com and *.example.com. This means that it covers any subdomain one level below the domain you signed up with. It will cover www.example.com and subdomain.example.com, as these are one level below the root domain, example.com. The certificate will not cover www.sub…