I got 2 certificates issued from "Let's Encrypt", one for "crackerscreed.org" and the other for "www.crackerscreed.org". The cPanel on my hosting service says:

When cPanel installs an SSL certificate onto one of your domains, it also installs the same certificate onto that domain’s “www” subdomain, and vice-versa. Unless your certificate matches both domains, however, only one of the two domains will show as a secure site in a user’s web browser.

Currently, I have the "crackerscreed.org" cert installed.

Now, if I try to visit https://crackerscreed.org it works perfectly fine but if the visitors try to visit https://www.crackerscreed.org, they receives an error saying "the connection is insecure". How do I deal with it?

3 Answers 3


You seem to have a problem with

  • understanding how https works,
  • what let’s encrypt certificates can do and
  • what you need

Let‘s make this as simple as possible: (For SNI, see below)

You have two certificates for two domains both hosted on the same IP. When a client connects and asks for a certificate, how would the server know what domain has been requested before the http request is handled?

The TLS handshake (the one where your server presents its certificate to the browser) comes before the http request by the browser, otherwise the requests wouldn’t be encrypted nor authenticated.

This is where SAN (Subject Alternative name) comes into play: it allows for one certificate to be made out to different domains (for example www.test.com and test.com). You do not need two certificates but one for both domains.

Edit for future reference: Apart from SAN certificates for multiple domains, there is a method called SNI (Server Name Indication) that does allow for the server to know the domain name during the handshake. Thus, the server can know the host name at the right time and present the right certificate. This can be more complex to set up and maintain and in this case (the two domains belonging to and representing the same entity), a multiple domain certificate as described above does a better job at representing the situation than SNI.

  • 2
    Server Name Indication (SNI) allows to host several domain, each one with its own certificate, on the same listening port. Compatible client (and all recent browsers are) send the requested domain name as part of the TLS handshake to allow the server to use the right certificate. Nevertheless, for a simple domain with and without www prefix, then the OP should definitively use a single certificate and SAN as you describe. Nov 2, 2017 at 20:00
  • I know about SNI, but I wanted to keep it simple for OP;)
    – Tobi Nary
    Nov 3, 2017 at 4:18
  • 1
    @7_R3X: You can recreate new certificates for the same domain (up to 20 times per week to avoid abuse), there is no issue. Check the documentation of the tool you use to get the certificates signed by Let's Encrypt: it should offer a way to pass several domains for the same certificate request. Simply create a new certificate matching both domains, replace the certificate you are currently using with the new one and restart the web server, you should be good to go! Nov 3, 2017 at 8:50
  • 1
    @7_R3X: Yes, I confirm you that's this. Nov 3, 2017 at 14:34
  • 1
    @WhiteWinterWolf , SmokeDispenser : Thanks a lot for all the help.
    – 7_R3X
    Nov 3, 2017 at 15:23

It looks like you've installed the certificate for crackerscreed.org for the hostname www.crackerscreed.org. Since this is only for crackerscreed.org but not www.crackerscreed.org it means that subject(s) of the certificate does not match the hostname and thus the certificate validation fails.
Checking what certificate your site returns:

$ openssl s_client -connect www.crackerscreed.org:443 -servername  www.crackerscreed.org |\
  openssl x509 -text
    Subject: CN=crackerscreed.org
        X509v3 Subject Alternative Name: 
  • 1
    Yes, I know that much already and have mentioned this much in my question. I guess you missed the question I'm trying to ask. Please read the question once again.
    – 7_R3X
    Nov 2, 2017 at 18:32
  • 1
    @7_R3X: If your system does not support to install separate certificates for separate domains you need to get a certificate which matches both domain and www.domain. This can be done with multiple Subject Alternative Name records. Nov 2, 2017 at 18:54

When creating the signature the request for Let's Encrypt the domain www.crackerscreed.org has been ignored from your command-line arguments or superseded by the other domain instead of being added.

You must check and correct your command-line accordingly (feel free to add it as additional information to your post).

Don't forget to use the Let's Encrypt sandbox URL while testing until you get your commands right, otherwise you follow the path for a one week ban from Let's Encrypt due to rate limits ;).

  • 1
    I guess there's a misundersting. I have two different certificates, one for my domain with 'www' and the other for my domain without 'www'.
    – 7_R3X
    Nov 2, 2017 at 18:30
  • @7_R3X: Your question was indeed initially wrongly stated, as using one certificate for both domains is actually the way to go. Independent certificates would be suitable for independent domains, which is not the case here. SmokeDispenser outlined the most important ideas in his answer. Nov 2, 2017 at 20:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .