1

When I check on browser for a site example.com, I see that site has a valid certificate, not expired, with validity till end of 2016.

At the same time, When I scan for the same domain on the port 443 using a Python script which I have developed, I get example.com certificate as expired and different from the non-expired certificate.

Why do domains serve two different certificates?

  • Well, you can usually assume that certs you can see in the Browser are correct. Maybe your implementation had a bug? Hard to say without reviewing the code. – AdHominem Jan 29 '16 at 7:44
  • My guess is this is a cluster and some of the machines have the old certificate – paj28 Jan 29 '16 at 8:27
  • Related: SF, 2015-10-02, ssl certificate self signed instead of valid – StackzOfZtuff Jan 29 '16 at 8:45
9

My guess is that this site is using Server Name Indication (SNI). In this case the served certificates depends on the hostname specified in the SNI extension and will often differ if no SNI extension is used. I.e. it will be some completely different default certificate or it will be some old certificate because they only replaced the certificate used for SNI when renewing the certificate.

Modern browsers all use SNI for years while outside the browsers the support is mixed. Support for SNI was added to Python with version 2.7.9 in 12/2014. It might be that you are running an older version of Python or that you are using a lower level access to the SSL connection where you have to explicitly set the SNI extension yourself.

In theory one could also send different certificates depending on the capabilities of the client, i.e. certificates signed with SHA-256 for a TLS 1.2 client but a SHA-1 certificate for a TLS 1.0 client. In practice most TLS stacks don't offer this kind of behavior or make it hard to use and thus servers don't implement such a feature. Thus I guess that your problem is related to SNI.

  • 1
    Exactly @Steffen,Just wrote a simple code in python to request for cert from a domain using python 2.7.3 and checked the cert response in wireshark and could see that no SNI information from the client( python 2.7.3) which is requesting and checked with upgrading to 2.7.11,Output was exact match to the original certificate that the domain has. Thanks for clear explanation. – Arun Jan 29 '16 at 17:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.