title: Why can a https website with a mismatching certificate domain name be marked as 'secure' by browser?
body: <p>I have basic knowledge of SSL and can configure web site https certificate.<br />
  I used to believe</p>
  <blockquote>
  <p>A 'secure' https website much have a matching(at least a wildcard
  matching) certificate domain name</p>
  </blockquote>
  <p>until today.</p>
  <p>Take <a href="https://www.google.com/" rel="nofollow noreferrer">google.com</a> as example:</p>
  <ul>
  <li>By Chrome certificate viewer:</li>
  </ul>
  <p><a href="https://i.stack.imgur.com/FTGOf.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/FTGOf.jpg" alt="enter image description here" /></a></p>
  <ul>
  <li>By openssl</li>
  </ul>
  <pre class="lang-sh prettyprint-override"><code>openssl s_client -connect google.com
  </code></pre>
  <p>Got same result:</p>
  <blockquote>
  <p>... depth=0 CN = *.google.com ...</p>
  </blockquote>
  <p>This is just woking as expected for me.</p>
  <p>But I just found(which was mistake when expecting <a href="https://cn.bing.com/" rel="nofollow noreferrer">cn.bing.com</a> actually) a website <a href="https://bing.cn/" rel="nofollow noreferrer">bing.cn</a>,</p>
  <ul>
  <li>By Chrome certificate viewer:</li>
  </ul>
  <p><a href="https://i.stack.imgur.com/VWnnr.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/VWnnr.jpg" alt="enter image description here" /></a></p>
  <ul>
  <li>By openssl</li>
  </ul>
  <pre class="lang-sh prettyprint-override"><code>openssl s_client -connect bing.cn
  </code></pre>
  <p>Got different result:</p>
  <blockquote>
  <p>... depth=0 CN = *.wordpress.com ...</p>
  </blockquote>
  <p>And this is beyond my knowledge. Could you explain</p>
  <ol>
  <li>Why can the domain name be different with certificate but still is secure?</li>
  <li>Why does gui version(<code>tls.automattic.com</code>) and command version(<code>*.wordpress.com</code>) show different certificate  domains?</li>
  </ol>