I found a website where all browsers navigate to just fine and do not complain about the certificates. When i inspect the certificate i noticed something i hadn't thought i would see. the website foo.net is using a certificate that was issued to common name .foo.com . Is this normal to do? I found it because i was using python to check the certificate expiration and it resulted in a "ssl.CertificateError: hostname 'foo.net' doesn't match either off '.foo.com', 'foo.com'".

I am not a certificate expert so not sure what the pro's and con's or when this is normally done if at all.

  • 4
    Did you check the subject alternative name (SAN) list of the certificate? Mar 27, 2017 at 17:34
  • 3
    Do you mind sharing the domain?
    – Arminius
    Mar 27, 2017 at 17:53
  • 1
    Post the full certificate info here
    – user13695
    Mar 27, 2017 at 17:59
  • 3
    Problem solved. looks like this was a problem with the cert on port 80. it ends up returning a 302 to the url with the correct port which resolves just fine since it has the correct cert loaded on that port. I missed it because browsers follow the 302 and the resolves the cert correctly, but python was looking at the cert at 80 instead of following the 302 and then getting the cert from the final url. still surprises me that with an invalid cert it would follow the 302.
    – Jtello
    Mar 27, 2017 at 23:13
  • Browsers won't follow 302 with bad cert. But usually port 80 doesn't serve certificate, that's why your browsers follow.
    – Yehuda
    Sep 20, 2018 at 15:46


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.