Untrusted Connection after installing SSL Certificates from Let's Encrypt

Question

I got 2 certificates issued from "Let's Encrypt", one for "crackerscreed.org" and the other for "www.crackerscreed.org". The cPanel on my hosting service says:

When cPanel installs an SSL certificate onto one of your domains, it also installs the same certificate onto that domain’s “www” subdomain, and vice-versa. Unless your certificate matches both domains, however, only one of the two domains will show as a secure site in a user’s web browser.

Currently, I have the "crackerscreed.org" cert installed.

Now, if I try to visit https://crackerscreed.org it works perfectly fine but if the visitors try to visit https://www.crackerscreed.org, they receives an error saying "the connection is insecure". How do I deal with it?

Answer 1

You seem to have a problem with

• understanding how https works,
• what let’s encrypt certificates can do and
• what you need

Let‘s make this as simple as possible: (For SNI, see below)

You have two certificates for two domains both hosted on the same IP. When a client connects and asks for a certificate, how would the server know what domain has been requested before the http request is handled?

The TLS handshake (the one where your server presents its certificate to the browser) comes before the http request by the browser, otherwise the requests wouldn’t be encrypted nor authenticated.

This is where SAN (Subject Alternative name) comes into play: it allows for one certificate to be made out to different domains (for example www.test.com and test.com). You do not need two certificates but one for both domains.

Edit for future reference: Apart from SAN certificates for multiple domains, there is a method called SNI (Server Name Indication) that does allow for the server to know the domain name during the handshake. Thus, the server can know the host name at the right time and present the right certificate. This can be more complex to set up and maintain and in this case (the two domains belonging to and representing the same entity), a multiple domain certificate as described above does a better job at representing the situation than SNI.

Answer 2

It looks like you've installed the certificate for crackerscreed.org for the hostname www.crackerscreed.org. Since this is only for crackerscreed.org but not www.crackerscreed.org it means that subject(s) of the certificate does not match the hostname and thus the certificate validation fails.
Checking what certificate your site returns:

$ openssl s_client -connect www.crackerscreed.org:443 -servername  www.crackerscreed.org |\
  openssl x509 -text
...
    Subject: CN=crackerscreed.org
...
        X509v3 Subject Alternative Name: 
            DNS:crackerscreed.org

Answer 3

When creating the signature the request for Let's Encrypt the domain www.crackerscreed.org has been ignored from your command-line arguments or superseded by the other domain instead of being added.

You must check and correct your command-line accordingly (feel free to add it as additional information to your post).

Don't forget to use the Let's Encrypt sandbox URL while testing until you get your commands right, otherwise you follow the path for a one week ban from Let's Encrypt due to rate limits ;).