Certificate not valid for domain

Help
1

Hi,

I am trying to setup a wildcard SSL for my domain. I generated it using certbot and got the congratulations message via:

/usr/local/bin/certbot-auto certonly --manual --preferred-challenges=dns --email=peter@mydomain.com --server https://acme-v02.api.letsencrypt.org/directory --agree-tos -d mydomain.com

Going to https://www.mydomain.com works fine, the problem is when I go to https://mydomain.com in Firefox I get:

Web sites prove their identity via certificates. Firefox does not trust this site because it uses a certificate that is not valid for mydomain.com. The certificate is only valid for www.mydomain.com.

Here is my Apache config:

<IfModule mod_ssl.c>
<VirtualHost *:443>
        ServerAdmin peter@mydomain.com
        ServerName mydomain.com
        ServerAlias www.mydomain.com audio.mydomain.com mydomain.com

        DocumentRoot /home/mydomain/repos/mydomain.com/public
        <Directory /home/mydomain/repos/mydomain.com/public>
                Allowoverride All
                Options FollowSymLinks
                Require all granted
        </Directory>

        CustomLog ${APACHE_LOG_DIR}/access.log combined
        ErrorLog ${APACHE_LOG_DIR}/error.log

SSLCertificateFile /etc/letsencrypt/live/mydomain.com-0001/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/mydomain.com-0001/privkey.pem

Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
</IfModule>

This is the output of apachectl -S

VirtualHost configuration:
*:443                  is a NameVirtualHost
         default server mydomain.com (/etc/apache2/sites-enabled/001-mydomain.com-le-ssl.conf:2)
         port 443 namevhost mydomain.com (/etc/apache2/sites-enabled/001-mydomain.com-le-ssl.conf:2)
                 alias www.mydomain.com
                 alias mydomain.com
         port 443 namevhost mydomain.com (/etc/apache2/sites-enabled/002-bookstack-le-ssl.conf:2)
                 alias wiki.mydomain.com
         port 443 namevhost git.mydomain.com (/etc/apache2/sites-enabled/003-gog-le-ssl.conf:2)
                 alias git
*:80                   is a NameVirtualHost
         default server mydomain.com (/etc/apache2/sites-enabled/001-mydomain.com.conf:1)
         port 80 namevhost mydomain.com (/etc/apache2/sites-enabled/001-mydomain.com.conf:1)
                 alias www.mydomain.com
                 alias audio.mydomain.com
         port 80 namevhost mydomain.com (/etc/apache2/sites-enabled/002-bookstack.conf:1)
                 alias wiki.mydomain.com
         port 80 namevhost git.mydomain.com (/etc/apache2/sites-enabled/003-gog.conf:1)
                 alias git
ServerRoot: "/etc/apache2"
Main DocumentRoot: "/var/www/html"
Main ErrorLog: "/var/log/apache2/error.log"
Mutex ssl-stapling: using_defaults
Mutex proxy: using_defaults
Mutex ssl-cache: using_defaults
Mutex default: dir="/var/lock/apache2" mechanism=fcntl
Mutex mpm-accept: using_defaults
Mutex watchdog-callback: using_defaults
Mutex rewrite-map: using_defaults
PidFile: "/var/run/apache2/apache2.pid"
Define: DUMP_VHOSTS
Define: DUMP_RUN_CFG
User: name="www-data" id=33
Group: name="www-data" id=33

And the output of /usr/local/bin/certbot-auto certificates

Requesting to rerun /usr/local/bin/certbot-auto with root privileges...
/opt/eff.org/certbot/venv/local/lib/python2.7/site-packages/cryptography/hazmat/bindings/openssl/binding.py:163: CryptographyDeprecationWarning: OpenSSL version 1.0.1 is no longer supported by the OpenSSL project, please upgrade. The next version of cryptography will drop support for it.
  utils.CryptographyDeprecationWarning
Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Found the following certs:
  Certificate Name: audio.mydomain.com-0001
    Domains: audio.mydomain.com
    Expiry Date: 2020-03-29 10:11:53+00:00 (VALID: 89 days)
    Certificate Path: /etc/letsencrypt/live/audio.mydomain.com-0001/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/audio.mydomain.com-0001/privkey.pem
  Certificate Name: audio.mydomain.com
    Domains: audio.mydomain.com wiki.mydomain.com www.mydomain.com
    Expiry Date: 2019-05-23 11:46:42+00:00 (INVALID: EXPIRED)
    Certificate Path: /etc/letsencrypt/live/audio.mydomain.com/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/audio.mydomain.com/privkey.pem
  Certificate Name: mydomain.com-0001
    Domains: *.mydomain.com
    Expiry Date: 2020-03-29 10:42:02+00:00 (VALID: 89 days)
    Certificate Path: /etc/letsencrypt/live/mydomain.com-0001/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/mydomain.com-0001/privkey.pem
  Certificate Name: mydomain.com
    Domains: mydomain.com
    Expiry Date: 2020-03-29 10:50:21+00:00 (VALID: 89 days)
    Certificate Path: /etc/letsencrypt/live/mydomain.com/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/mydomain.com/privkey.pem
  Certificate Name: www.mydomain.com
    Domains: www.mydomain.com
    Expiry Date: 2020-03-29 10:12:30+00:00 (VALID: 89 days)
    Certificate Path: /etc/letsencrypt/live/www.mydomain.com/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/www.mydomain.com/privkey.pem
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Can anyone point me in the right direction ?

Thanks for your time,
Peter

1 Like
2

Hi @ItsPeter

your domain name is required.

1 Like
3

If this is actually the command you used, it didn't issue a wildcard cert, but instead a cert for only mydomain.com. That would result in the cert working for mydomain.com, but not for www.mydomain.com.

Beyond that, as the template you deleted before you posted tells you, we can't do much of anything to help you without the actual domain name.

2 Likes
4

Thanks Dan that helped a lot. To fix it I changed my apache config to have 2 virtual hosts using the different certificates, one for www.mydomain.com and one for mydomain.com

Thanks for your help.

1 Like
5

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.