diff --git a/lib/https/ca.js b/lib/https/ca.js
index 7a17e07a9..d07dd13b1 100644
--- a/lib/https/ca.js
+++ b/lib/https/ca.js
@@ -20,6 +20,8 @@ var customCertDir = config.certDir;
 var customPairs = {};
 var wildcardPairs = {};
 var cachePairs = {};
+var LEGAL_CHARS_RE = /[a-z\d-]/i;
+
 var ROOT_KEY, ROOT_CRT;
 
 if (config.ATS) {
@@ -60,17 +62,16 @@ function getCommonName(crt) {
 
 
 function createCertificate(hostname) {
+  var wildHost = hostname.substring(hostname.indexOf('.'));
   var cert = customPairs[hostname]
-    || wildcardPairs[hostname.slice(hostname.indexOf('.'))]
+    || wildcardPairs[wildHost]
     || cachePairs[hostname];
   if (cert) {
     return cert;
   }
-
-  cert = createCert(pki.setRsaPublicKey(ROOT_KEY.n, ROOT_KEY.e),
-crypto.createHash('sha1')
-.update(hostname, 'binary')
-.digest('hex'));
+  var serialNumber = crypto.createHash('sha1')
+    .update(hostname, 'binary').digest('hex');
+  cert = createCert(pki.setRsaPublicKey(ROOT_KEY.n, ROOT_KEY.e), serialNumber);
 
   cert.setSubject([{
     name: 'commonName',