When I check on browser for a site example.com, I see that site has a valid certificate, not expired, with validity till end of 2016.

At the same time, When I scan for the same domain on the port 443 using a Python script which I have developed, I get example.com certificate as expired and different from the non-expired certificate.

Why do domains serve two different certificates?

  • Well, you can usually assume that certs you can see in the Browser are correct. Maybe your implementation had a bug? Hard to say without reviewing the code.
    – AdHominem
    Jan 29, 2016 at 7:44
  • My guess is this is a cluster and some of the machines have the old certificate
    – paj28
    Jan 29, 2016 at 8:27
  • Related: SF, 2015-10-02, ssl certificate self signed instead of valid Jan 29, 2016 at 8:45

1 Answer 1


My guess is that this site is using Server Name Indication (SNI). In this case the served certificates depends on the hostname specified in the SNI extension and will often differ if no SNI extension is used. I.e. it will be some completely different default certificate or it will be some old certificate because they only replaced the certificate used for SNI when renewing the certificate.

Modern browsers all use SNI for years while outside the browsers the support is mixed. Support for SNI was added to Python with version 2.7.9 in 12/2014. It might be that you are running an older version of Python or that you are using a lower level access to the SSL connection where you have to explicitly set the SNI extension yourself.

In theory one could also send different certificates depending on the capabilities of the client, i.e. certificates signed with SHA-256 for a TLS 1.2 client but a SHA-1 certificate for a TLS 1.0 client. In practice most TLS stacks don't offer this kind of behavior or make it hard to use and thus servers don't implement such a feature. Thus I guess that your problem is related to SNI.

  • 1
    Exactly @Steffen,Just wrote a simple code in python to request for cert from a domain using python 2.7.3 and checked the cert response in wireshark and could see that no SNI information from the client( python 2.7.3) which is requesting and checked with upgrading to 2.7.11,Output was exact match to the original certificate that the domain has. Thanks for clear explanation.
    – Arun
    Jan 29, 2016 at 17:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .