I found a website where all browsers navigate to just fine and do not complain about the certificates. When i inspect the certificate i noticed something i hadn't thought i would see. the website foo.net is using a certificate that was issued to common name .foo.com . Is this normal to do? I found it because i was using python to check the certificate expiration and it resulted in a "ssl.CertificateError: hostname 'foo.net' doesn't match either off '.foo.com', 'foo.com'".

I am not a certificate expert so not sure what the pro's and con's or when this is normally done if at all.

  • 4
    Did you check the subject alternative name (SAN) list of the certificate? – CodesInChaos Mar 27 '17 at 17:34
  • 3
    Do you mind sharing the domain? – Arminius Mar 27 '17 at 17:53
  • 1
    Post the full certificate info here – Jan Doggen Mar 27 '17 at 17:59
  • 3
    Problem solved. looks like this was a problem with the cert on port 80. it ends up returning a 302 to the url with the correct port which resolves just fine since it has the correct cert loaded on that port. I missed it because browsers follow the 302 and the resolves the cert correctly, but python was looking at the cert at 80 instead of following the 302 and then getting the cert from the final url. still surprises me that with an invalid cert it would follow the 302. – Jtello Mar 27 '17 at 23:13
  • Browsers won't follow 302 with bad cert. But usually port 80 doesn't serve certificate, that's why your browsers follow. – Yehuda Sep 20 '18 at 15:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.