# Issue with SSL on www. subdomain **URL:** \ **Category:** Help\ **Created:** [October 7, 2017, 12:10am UTC](https://community.letsencrypt.org/t/issue-with-ssl-on-www-subdomain/43721 "2017-10-07T00:10:16Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![brewbart](https://avatars.discourse-cdn.com/v4/letter/b/91b2a8/32.png) [@brewbart](https://community.letsencrypt.org/u/brewbart)\ **Post date:** [October 7, 2017, 12:10am UTC](https://community.letsencrypt.org/t/issue-with-ssl-on-www-subdomain/43721/1 "2017-10-07T00:10:16Z")
Hello, I tried searching for a solution and ran through some of the stuff I thought might help but its not. I ran certbot prior to having my virtual hosts set up correctly. I am currenty using Centos 7 and Certbot to create my ssl certificates. The domain is [happyhandsprep.com](http://happyhandsprep.com). When I attempt to go to [www.happyhandsprep.com](http://www.happyhandsprep.com) I get the server mismatch IE The hostname in the website’s security certificate differs from the website you are trying to visit. Error Code: DLG\_FLAGS\_SEC\_CERT\_CN\_INVALID Firefox [www.happyhandsprep.com](http://www.happyhandsprep.com) uses an invalid security certificate. The certificate is only valid for [happyhandsprep.com](http://happyhandsprep.com) Error code: SSL\_ERROR\_BAD\_CERT\_DOMAIN I added the virtual hosts to my config as follows \ ServerAdmin [admin@happyhandsprep.com](mailto:admin@happyhandsprep.com) DocumentRoot /var/www/html serverName [happyhandsprep.com](http://happyhandsprep.com) ServerAlias [www.happyhandsprep.com](http://www.happyhandsprep.com) I then attempted to update the cert using sudo certbot --apache certonly -d [happyhandsprep.com](http://happyhandsprep.com) -d [www.happyhandsprep.com](http://www.happyhandsprep.com). It says it was successful but still when I go to the www. version it still throws the certificate error. Any insight into how I can correct this would be appreciated. ---
**Author:** ![Patches](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/patches/32/17145_2.png) [@Patches](https://community.letsencrypt.org/u/Patches)\ **Post date:** [October 7, 2017, 12:17am UTC](https://community.letsencrypt.org/t/issue-with-ssl-on-www-subdomain/43721/2 "2017-10-07T00:17:43Z")
Can you confirm with `certbot certificates` that you really have a certificate encompassing the `www` domain? Did you reload Apache after issuing the new certificate? Are the paths to the certificate defined in both `VirtualHost`s, just one, or some place they are inherited by both? ---
**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\ **Post date:** [October 7, 2017, 12:18am UTC](https://community.letsencrypt.org/t/issue-with-ssl-on-www-subdomain/43721/3 "2017-10-07T00:18:26Z")
There are several certificates for the domain. Some are for “`happyhandsprep.com`”, some are for “`www.happyhandsprep.com`” and some are for both. [https://crt.sh/?q=%happyhandsprep.com](https://crt.sh/?q=%25happyhandsprep.com) The web server is currently using this older one, which is only for “`happyhandsprep.com`”. [https://crt.sh/?id=225376955](https://crt.sh/?id=225376955) I’m not certain what “`sudo certbot --apache certonly`” does, to be honest. It may issue a certificate, and then _not_ configure the web server to use it. Could you show us its output? And the Apache configuration file(s)? And also what @Patches said. Edit: Additionally, you need to mind the Duplicate Certificate rate limit. [https://letsencrypt.org/docs/rate-limits/](https://letsencrypt.org/docs/rate-limits/) ---
**Author:** ![brewbart](https://avatars.discourse-cdn.com/v4/letter/b/91b2a8/32.png) [@brewbart](https://community.letsencrypt.org/u/brewbart)\ **Post date:** [October 7, 2017, 12:24am UTC](https://community.letsencrypt.org/t/issue-with-ssl-on-www-subdomain/43721/4 "2017-10-07T00:24:34Z")
Found the following certs: Certificate Name: happyhandsprep.com-0001 Domains: [happyhandsprep.com](http://happyhandsprep.com) Expiry Date: 2018-01-04 19:44:12+00:00 (VALID: 89 days) Certificate Path: /etc/letsencrypt/live/happyhandsprep.com-0001/fullchain.pe m Private Key Path: /etc/letsencrypt/live/happyhandsprep.com-0001/privkey.pem Certificate Name: [www.happyhandsprep.com](http://www.happyhandsprep.com) Domains: [www.happyhandsprep.com](http://www.happyhandsprep.com) Expiry Date: 2018-01-04 20:15:13+00:00 (VALID: 89 days) Certificate Path: /etc/letsencrypt/live/www.happyhandsprep.com/fullchain.pem Private Key Path: /etc/letsencrypt/live/www.happyhandsprep.com/privkey.pem I did reload apache. How do i go about cleaning up the certificates and getting it to use the newest certificate? ---
**Author:** ![Patches](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/patches/32/17145_2.png) [@Patches](https://community.letsencrypt.org/u/Patches)\ **Post date:** [October 7, 2017, 12:39am UTC](https://community.letsencrypt.org/t/issue-with-ssl-on-www-subdomain/43721/5 "2017-10-07T00:39:23Z")
So you have two certificates, one with and and without www, but the certificate that contains both is missing. What is the output of? ```auto ls -lR /etc/letsencrypt/archive ls -lR /etc/letsencrypt/live ``` And what is the `SSLCertificateFile` currently configured with Apache? ---
**Author:** ![brewbart](https://avatars.discourse-cdn.com/v4/letter/b/91b2a8/32.png) [@brewbart](https://community.letsencrypt.org/u/brewbart)\ **Post date:** [October 7, 2017, 1:02am UTC](https://community.letsencrypt.org/t/issue-with-ssl-on-www-subdomain/43721/6 "2017-10-07T01:02:20Z")
I really appreciate the replies. It guided me to the place where I had to be to fix the issue. Essentially I went into the config that is pointed to by the SSLCertificateFile which I found using grep -i -r “SSLCertificateFile” /etc/httpd/ and edited the virtual host there. I was unaware it was using that rather than my main httpd.conf file. Once i updated it to use the latest certificate that had both URLs i am no longer throwing that security error. Thanks a million for the help and this has been a huge learning experience in apache/centos7 and SSL certs ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [October 7, 2017, 1:09am UTC](https://community.letsencrypt.org/t/issue-with-ssl-on-www-subdomain/43721/7 "2017-10-07T01:09:06Z")
> [@brewbart](#): > > certonly I think that will only get the cert and nothing more as you may have expected. ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [October 8, 2017, 4:47am UTC](https://community.letsencrypt.org/t/issue-with-ssl-on-www-subdomain/43721/8 "2017-10-08T04:47:09Z")
Agreed with @rg305 and @mnordhoff that `certbot --apache certonly` is not necessarily desirable. It will indeed obtain a certificate and not attempt to install it, which not very many Apache users have a reason to prefer. 🙂 `certonly` has various uses but is often meant for use with plugins like `--webroot` that don’t provide an installer functionality at all. `--apache` isn’t in this category. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [November 7, 2017, 4:47am UTC](https://community.letsencrypt.org/t/issue-with-ssl-on-www-subdomain/43721/9 "2017-11-07T04:47:14Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.