1

Assume a website whose Common Name of SSL certificate is this

myonlinebank.example.com

Assume a website whose Common Name of SSL certificate is this

*.example.com

Users are using adguard dns.

dns.adguard.com

And when they try to access the first site(the one without wildcard certificate), they get this error:

NET::ERR_CERT_COMMON_NAME_INVALID

Why? And what are the potential clever solutions(by using nginx config or otherwise) of this issue except purchasing a new wildcard certificate?


I'll put everything that I know about SSL protocol here:

enter image description here

We're using nginx server with we've enabled TLS. And this is the current nginx configuration.

server {
        listen          443 ssl;
        server_name     myonlinebank.example.com;
}

When I browse the site, the certificate shown is that of adguard. There's no option to view that site's own certificate.

enter image description here

7
  • The common name is basically never a wildcard. The common name is actually irrelevant, instead Subject Alternative Names are used. Based on this I doubt the claim in your title about Adguard having problems with non-wildcards in CN. And you don't show any details how you arrived at this claim. Based on this I don't think that your question can be answered with the currently provided information and (likely) wrong claims. Commented Dec 17, 2023 at 16:09
  • I used the linux command to get the common name,openssl x509 -noout -subject -in certificate1.crt
    – Team B.I
    Commented Dec 17, 2023 at 16:17
  • It does not matter what command you used to get the CN. Like I said, the common name should be irrelevant, instead SAN are used. It looks like that you got an error, then came up with your own explanation for this error and then ask how to work around based on your understanding of the problem. Only, this explanation you base your question on is likely wrong. Commented Dec 17, 2023 at 16:23
  • The error is pretty clear on what it's trying to say. AFAIK. I appreciate your humbleness though.
    – Team B.I
    Commented Dec 17, 2023 at 16:27
  • Unfortunately, the error NET::ERR_CERT_COMMON_NAME_INVALID you get is misleading. It comes from a time where the CN was actually checked and was never changed even though CN is no longer relevant but SAN is. Your browser should offer to provide you with more details (button "Advanced" or so) - please include these in your question. Commented Dec 17, 2023 at 16:29

1 Answer 1

3

If a domain is blocked by Adguard DNS server it will not return the IP address of the original server, but instead of a server controlled by Adguard itself.

This Adguard controlled server does not return the certificate for your domain since it has no access to it (specifically to the private key of your certificate). Instead it returns a certificate for dns.adguard.com. Since this certificate does not match the domain from the URL the browser will complain.

There is nothing you can do in your server or certificate to fix this. Your server isn't even involved in all of this, only Adguards servers are involved. The only thing you can do is to somehow make sure that Adguard will not block your domain.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .