I'm migrating a secure website. I've installed the same certificate on the new host and pointed the domain name to the new IP address (via my hosts file). However, when I try to hit that server with a web browser, I get certificate verification error.
To complicate matters, the new host is a service that uses SNI. Therefore, the error message I'm shown, that the domain name does not match the cert, is referring to the cert before SNI. I'm doubtful SNI is set up incorrectly since every other connection works.
To try to diagnose the problem, I used
openssl s_client. To my dismay,
openssl does not have problems connecting, and I see no errors when issuing an HTTP request:
openssl s_client -connect <ipaddress>:443 -servername <domainname> -showcerts -debug
Are there any other tools out there to diagnose why web browsers (I've tested with Chrome, Firefox, and IE) are rejecting a certificate despite the fact that
openssl s_client does not?
Here's the abbreviated output from
openssl in case you can spot the issue:
CONNECTED(00000003) Certificate chain 0 s:<subject details> i:<issuer details> <certificate> 1 s:<subject details> i:<issuer details> <certificate> 2 s:<subject> i:<issuer, same as subject> <certificate> --- Server certificate [certificate information] --- No client certificate CA names sent Server Temp Key: ECDH, prime256v1, 256 bits --- SSL handshake has read 4392 bytes and written 408 bytes --- New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384 Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-GCM-SHA384 Session-ID: <session id> Session-ID-ctx: Master-Key: <master key> Key-Arg : None Krb5 Principal: None PSK identity: None PSK identity hint: None TLS session ticket lifetime hint: 300 (seconds) TLS session ticket: <hex output> Start Time: 1434382473 Timeout : 300 (sec) Verify return code: 0 (ok) --- read:errno=0
Chrome reports "Server's certificate does not match the URL," but as I said, this is because of using SNI; it is complaining that the certificate used to initially connect doesn't match the URL.
openssl does the SNI thing just fine, so I'm thinking the browser is rejecting the certificate that
uses an invalid security certificate. The certificate is only valid for the following names: (Error code: ssl_error_bad_cert_domain)
The security certificate presented by this website was issued for a different website's address.
Thanks everyone for your help. Details are hard to provide in my case for a variety of issues. I found the issue though. The certificate was properly installed and accepted. What I did not notice is that the site performed a redirect to a domain for which the cert was not installed properly (www.thedomainname.com). I wish I had noticed earlier.