0

I got 2 certificates issued from "Let's Encrypt", one for "crackerscreed.org" and the other for "www.crackerscreed.org". The cPanel on my hosting service says:

When cPanel installs an SSL certificate onto one of your domains, it also installs the same certificate onto that domain’s “www” subdomain, and vice-versa. Unless your certificate matches both domains, however, only one of the two domains will show as a secure site in a user’s web browser.

Currently, I have the "crackerscreed.org" cert installed.

Now, if I try to visit https://crackerscreed.org it works perfectly fine but if the visitors try to visit https://www.crackerscreed.org, they receives an error saying "the connection is insecure". How do I deal with it?

2

You seem to have a problem with

  • understanding how https works,
  • what let’s encrypt certificates can do and
  • what you need

Let‘s make this as simple as possible: (For SNI, see below)

You have two certificates for two domains both hosted on the same IP. When a client connects and asks for a certificate, how would the server know what domain has been requested before the http request is handled?

The TLS handshake (the one where your server presents its certificate to the browser) comes before the http request by the browser, otherwise the requests wouldn’t be encrypted nor authenticated.

This is where SAN (Subject Alternative name) comes into play: it allows for one certificate to be made out to different domains (for example www.test.com and test.com). You do not need two certificates but one for both domains.

Edit for future reference: Apart from SAN certificates for multiple domains, there is a method called SNI (Server Name Indication) that does allow for the server to know the domain name during the handshake. Thus, the server can know the host name at the right time and present the right certificate. This can be more complex to set up and maintain and in this case (the two domains belonging to and representing the same entity), a multiple domain certificate as described above does a better job at representing the situation than SNI.

  • 2
    Server Name Indication (SNI) allows to host several domain, each one with its own certificate, on the same listening port. Compatible client (and all recent browsers are) send the requested domain name as part of the TLS handshake to allow the server to use the right certificate. Nevertheless, for a simple domain with and without www prefix, then the OP should definitively use a single certificate and SAN as you describe. – WhiteWinterWolf Nov 2 '17 at 20:00
  • I know about SNI, but I wanted to keep it simple for OP;) – Tobi Nary Nov 3 '17 at 4:18
  • 1
    @7_R3X: You can recreate new certificates for the same domain (up to 20 times per week to avoid abuse), there is no issue. Check the documentation of the tool you use to get the certificates signed by Let's Encrypt: it should offer a way to pass several domains for the same certificate request. Simply create a new certificate matching both domains, replace the certificate you are currently using with the new one and restart the web server, you should be good to go! – WhiteWinterWolf Nov 3 '17 at 8:50
  • 1
    @7_R3X: Yes, I confirm you that's this. – WhiteWinterWolf Nov 3 '17 at 14:34
  • 1
    @WhiteWinterWolf , SmokeDispenser : Thanks a lot for all the help. – 7_R3X Nov 3 '17 at 15:23
1

It looks like you've installed the certificate for crackerscreed.org for the hostname www.crackerscreed.org. Since this is only for crackerscreed.org but not www.crackerscreed.org it means that subject(s) of the certificate does not match the hostname and thus the certificate validation fails.
Checking what certificate your site returns:

$ openssl s_client -connect www.crackerscreed.org:443 -servername  www.crackerscreed.org |\
  openssl x509 -text
...
    Subject: CN=crackerscreed.org
...
        X509v3 Subject Alternative Name: 
            DNS:crackerscreed.org
  • 1
    Yes, I know that much already and have mentioned this much in my question. I guess you missed the question I'm trying to ask. Please read the question once again. – 7_R3X Nov 2 '17 at 18:32
  • 1
    @7_R3X: If your system does not support to install separate certificates for separate domains you need to get a certificate which matches both domain and www.domain. This can be done with multiple Subject Alternative Name records. – Steffen Ullrich Nov 2 '17 at 18:54
1

When creating the signature the request for Let's Encrypt the domain www.crackerscreed.org has been ignored from your command-line arguments or superseded by the other domain instead of being added.

You must check and correct your command-line accordingly (feel free to add it as additional information to your post).

Don't forget to use the Let's Encrypt sandbox URL while testing until you get your commands right, otherwise you follow the path for a one week ban from Let's Encrypt due to rate limits ;).

  • 1
    I guess there's a misundersting. I have two different certificates, one for my domain with 'www' and the other for my domain without 'www'. – 7_R3X Nov 2 '17 at 18:30
  • @7_R3X: Your question was indeed initially wrongly stated, as using one certificate for both domains is actually the way to go. Independent certificates would be suitable for independent domains, which is not the case here. SmokeDispenser outlined the most important ideas in his answer. – WhiteWinterWolf Nov 2 '17 at 20:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.