# LetsEncrypt randomly switching to issuing a cert to the hostname instead of domain name

**URL:** <https://community.letsencrypt.org/t/letsencrypt-randomly-switching-to-issuing-a-cert-to-the-hostname-instead-of-domain-name/146954>\
**Category:** Help\
**Created:** [March 8, 2021, 7:50pm UTC](https://community.letsencrypt.org/t/letsencrypt-randomly-switching-to-issuing-a-cert-to-the-hostname-instead-of-domain-name/146954 "2021-03-08T19:50:47Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![0nionboi](https://avatars.discourse-cdn.com/v4/letter/0/6de8d8/32.png) [@0nionboi](https://community.letsencrypt.org/u/0nionboi)\
**Post date:** [March 8, 2021, 7:50pm UTC](https://community.letsencrypt.org/t/letsencrypt-randomly-switching-to-issuing-a-cert-to-the-hostname-instead-of-domain-name/146954/1 "2021-03-08T19:50:47Z")

</div>

As stated in the title, I have a website that lives in a virtual machine with a letsencrypt cert. Setting up letsencrypt via certbot went smoothly, but 4 days later, the cert on the site switched back to the name of the server, rather than the domain name. I went in and reissued the cert and cleaned out all the cert files from the setup, when it detected and tried issuing a cert for the hostname of the server - and it was fine for another 2 weeks.

After reissuing the cert again, I did a force renewal to doublecheck that it wasn't the renewal script causing the issue and it renewed without a problem.

Anyone have any insight on why this is happening? It is worth noting that the vm was a staging site for the website for some time, and had a url of its own during that time.

My web server is (include version): apache on RHEL 7

My hosting provider, if applicable, is: Databank

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): Certbot 1.13.0

Command I used for the setup:  
certbot --apache -d mydomainname -d www.mydomainname

For renewal I used:  
certbot renew --force-renewal

Thanks

---

<div class="post-metadata">

**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\
**Post date:** [March 8, 2021, 9:00pm UTC](https://community.letsencrypt.org/t/letsencrypt-randomly-switching-to-issuing-a-cert-to-the-hostname-instead-of-domain-name/146954/2 "2021-03-08T21:00:07Z")

</div>

> [@0nionboi](#):
>
> Setting up letsencrypt via certbot went smoothly, but 4 days later, the cert on the site switched back to the name of the server, rather than the domain name.

Hi @0nionboi,

Could you be more explicit about what you mean by "switched back to"?

Did you start getting a certificate error in your browser because the server was presenting a certificate for a different name than the name you were trying to connect to?

By "the hostname" or "the server name", do you mean a name that's assigned by your hosting provider for your server VM instance, that's distinct from the domain name that you've registered and that people normally use to connect to your site?

---

<div class="post-metadata">

**Author:** ![0nionboi](https://avatars.discourse-cdn.com/v4/letter/0/6de8d8/32.png) [@0nionboi](https://community.letsencrypt.org/u/0nionboi)\
**Post date:** [March 8, 2021, 9:36pm UTC](https://community.letsencrypt.org/t/letsencrypt-randomly-switching-to-issuing-a-cert-to-the-hostname-instead-of-domain-name/146954/3 "2021-03-08T21:36:41Z")

</div>

Happy to do so - After the cert is installed, I navigate to the website and check the site info, view the cert info, and all the details of the cert are correct, with the Common Name matching the name of my website.

When it switches, I notice that the SSL is failing validation and the page is insecure. When I go into the site info to view the cert, the Common Name on the cert is set to the hostname of the server - the name provided by my hosting provider for that VM instance.

Hope that helps.

---

<div class="post-metadata">

**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\
**Post date:** [March 8, 2021, 11:46pm UTC](https://community.letsencrypt.org/t/letsencrypt-randomly-switching-to-issuing-a-cert-to-the-hostname-instead-of-domain-name/146954/4 "2021-03-08T23:46:18Z")

</div>

Thanks! Is the non-matching certificate apparently _valid_, just not the right one for your domain name?

Could you try running `certbot certificates` to see which certificates you have that are managed by Certbot?

---

<div class="post-metadata">

**Author:** ![0nionboi](https://avatars.discourse-cdn.com/v4/letter/0/6de8d8/32.png) [@0nionboi](https://community.letsencrypt.org/u/0nionboi)\
**Post date:** [March 9, 2021, 2:59pm UTC](https://community.letsencrypt.org/t/letsencrypt-randomly-switching-to-issuing-a-cert-to-the-hostname-instead-of-domain-name/146954/5 "2021-03-09T14:59:35Z")

</div>

Yes, that's the strange thing. The non-matching cert looks valid, but it fails the website validation because it doesn't match the URL/domain name of the site.

certbot certificates looks good - I see only this, which is expected:

* * *

Found the following certs:  
Certificate Name: mydomainname  
Serial Number: 3c562f5863bc79166d50b943f1061ac106c  
Key Type: RSA  
Domains: mydomainname www.mydomainname  
Expiry Date: 2021-06-06 18:00:26+00:00 (VALID: 89 days)  
Certificate Path: /etc/letsencrypt/live/mydomainname/fullchain.pem  
Private Key Path: /etc/letsencrypt/live/mydomainname/privkey.pem

* * *

---

<div class="post-metadata">

**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\
**Post date:** [March 9, 2021, 8:57pm UTC](https://community.letsencrypt.org/t/letsencrypt-randomly-switching-to-issuing-a-cert-to-the-hostname-instead-of-domain-name/146954/6 "2021-03-09T20:57:58Z")

</div>

Can you try this?

`sudo grep -ir SSLCert /etc/apache2`

or if you use CentOS or something else RHEL-like

`sudo grep -ir SSLCert /etc/httpd`

An alternative that could also be useful is

`sudo apachectl -t -D DUMP_VHOSTS`

---

<div class="post-metadata">

**Author:** ![jsha](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jsha/32/12_2.png) [@jsha](https://community.letsencrypt.org/u/jsha)\
**Post date:** [March 10, 2021, 5:04am UTC](https://community.letsencrypt.org/t/letsencrypt-randomly-switching-to-issuing-a-cert-to-the-hostname-instead-of-domain-name/146954/7 "2021-03-10T05:04:45Z")

</div>

Hi @0nionboi and welcome to the forum! I'd like to gently remind you that if you go ahead and tell us your domain name, we'll be able to help you a lot more quickly and effectively. Easier for you, easier for us. 🙂 All publicly issued certificates are searchable at via Certificate Transparency logs at [https://crt.sh/](https://crt.sh/) and elsewhere.

---

<div class="post-metadata">

**Author:** ![0nionboi](https://avatars.discourse-cdn.com/v4/letter/0/6de8d8/32.png) [@0nionboi](https://community.letsencrypt.org/u/0nionboi)\
**Post date:** [March 15, 2021, 5:03pm UTC](https://community.letsencrypt.org/t/letsencrypt-randomly-switching-to-issuing-a-cert-to-the-hostname-instead-of-domain-name/146954/8 "2021-03-15T17:03:24Z")

</div>

> [@jsha](#):
>
> Hi @0nionboi and welcome to the forum! I'd like to gently remind you that if you go ahead and tell us your domain name, we'll be able to help you a lot more quickly and effectively.

Haha I did read that originally, but the thought of it still wigs me out a little - the domain is brynathyn.edu

> [@schoen](#):
>
> or if you use CentOS or something else RHEL-like
> 
> `sudo grep -ir SSLCert /etc/httpd`

```
/etc/httpd/conf.d/ssl.conf:# Point SSLCertificateFile at a PEM encoded certificate. If
/etc/httpd/conf.d/ssl.conf:SSLCertificateFile /etc/pki/tls/certs/localhost.crt
/etc/httpd/conf.d/ssl.conf:SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
/etc/httpd/conf.d/ssl.conf:# Point SSLCertificateChainFile at a file containing the
/etc/httpd/conf.d/ssl.conf:# the referenced file can be the same as SSLCertificateFile
/etc/httpd/conf.d/ssl.conf:#SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt
/etc/httpd/sites/01-brynathyn.oudeve.com-le-ssl.conf.bak:SSLCertificateFile /etc/letsencrypt/live/brynathyn.edu/cert.pem
/etc/httpd/sites/01-brynathyn.oudeve.com-le-ssl.conf.bak:SSLCertificateKeyFile /etc/letsencrypt/live/brynathyn.edu/privkey.pem
/etc/httpd/sites/01-brynathyn.oudeve.com-le-ssl.conf.bak:SSLCertificateChainFile /etc/letsencrypt/live/brynathyn.edu/chain.pem
/etc/httpd/sites/01-brynathyn.oudeve.com-le-ssl.conf:SSLCertificateFile /etc/letsencrypt/live/brynathyn.edu/cert.pem
/etc/httpd/sites/01-brynathyn.oudeve.com-le-ssl.conf:SSLCertificateKeyFile /etc/letsencrypt/live/brynathyn.edu/privkey.pem
/etc/httpd/sites/01-brynathyn.oudeve.com-le-ssl.conf:SSLCertificateChainFile /etc/letsencrypt/live/brynathyn.edu/chain.pem
/etc/httpd/sites/01-brynathyn.oudeve.com.conf:# SSLCertificateFile /path/to/your_domain_name.crt
/etc/httpd/sites/01-brynathyn.oudeve.com.conf:# SSLCertificateKeyFile /path/to/your_private.key
/etc/httpd/sites/01-brynathyn.oudeve.com.conf:# SSLCertificateChainFile /path/to/CAfile.crt

```

> [@schoen](#):
>
> An alternative that could also be useful is
> 
> `sudo apachectl -t -D DUMP_VHOSTS`

```
    VirtualHost configuration:
*:443 is a NameVirtualHost
         default server s06007.databank.host (/etc/httpd/conf.d/ssl.conf:56)
         port 443 namevhost s06007.databank.host (/etc/httpd/conf.d/ssl.conf:56)
         port 443 namevhost brynathyn.edu (/etc/httpd/sites/01-brynathyn.oudeve.com-le-ssl.conf:2)
                 alias brynathyn.oudeve.com
                 alias www.brynathyn.edu
                 wild alias *
*:80 is a NameVirtualHost
         default server s06007.databank.host (/etc/httpd/sites/00-databank-monitoring-site.conf:4)
         port 80 namevhost s06007.databank.host (/etc/httpd/sites/00-databank-monitoring-site.conf:4)
         port 80 namevhost brynathyn.oudeve.com (/etc/httpd/sites/01-brynathyn.oudeve.com.conf:1)
                 alias brynathyn.edu
                 alias www.brynathyn.edu
                 wild alias *

```

Hey, that looks like something - s06007 is the common name that appears in my cert whenever it decides to stop using the one I manually create. Is it a matter of changing the default server? I'd probably have to work with the company that hosts the site, since I don't want anything else to break by making this change.

---

<div class="post-metadata">

**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\
**Post date:** [March 15, 2021, 7:07pm UTC](https://community.letsencrypt.org/t/letsencrypt-randomly-switching-to-issuing-a-cert-to-the-hostname-instead-of-domain-name/146954/9 "2021-03-15T19:07:02Z")

</div>

> [@0nionboi](#):
>
> Hey, that looks like something - s06007 is the common name that appears in my cert whenever it decides to stop using the one I manually create. Is it a matter of changing the default server? I'd probably have to work with the company that hosts the site, since I don't want anything else to break by making this change.

Huh! Is that company managing this server for you to some extent? Do you know how that VirtualHost came to have the "generic" hosting name explicitly listed in it in addition to your intended domain names?

---

<div class="post-metadata">

**Author:** ![0nionboi](https://avatars.discourse-cdn.com/v4/letter/0/6de8d8/32.png) [@0nionboi](https://community.letsencrypt.org/u/0nionboi)\
**Post date:** [March 15, 2021, 7:29pm UTC](https://community.letsencrypt.org/t/letsencrypt-randomly-switching-to-issuing-a-cert-to-the-hostname-instead-of-domain-name/146954/10 "2021-03-15T19:29:59Z")

</div>

The company built the site, and set it up in Databank for us, then handed it off to us. I'm almost positive that's from their configuration. Would that cause an error with Let's Encrypt? Even after I cleaned up the cert and force renewed it (to test the renewal), the configuration stuck. I'm still unsure what would cause it to switch to a cert for s06007.

---

<div class="post-metadata">

**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\
**Post date:** [March 15, 2021, 7:50pm UTC](https://community.letsencrypt.org/t/letsencrypt-randomly-switching-to-issuing-a-cert-to-the-hostname-instead-of-domain-name/146954/11 "2021-03-15T19:50:29Z")

</div>

I think the overlap between the virtual hosts defined in `ssl.conf` and `01-brynathyn.oudeve.com-le-ssl.conf` is causing some troubles. Could you post the whole contents of `ssl.conf`?

---

<div class="post-metadata">

**Author:** ![jvanasco](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jvanasco/32/55900_2.png) [@jvanasco](https://community.letsencrypt.org/u/jvanasco)\
**Post date:** [March 15, 2021, 9:01pm UTC](https://community.letsencrypt.org/t/letsencrypt-randomly-switching-to-issuing-a-cert-to-the-hostname-instead-of-domain-name/146954/12 "2021-03-15T21:01:42Z")

</div>

I swtiched to nginx long ago, but from what i remember of apache... i think this issue could happen because the server block for the desired websites has a catchall and/or hostname on it.

i typically set the desired websites into a single explicit serverblock, then use a separate catchall/default to redirect to the desired domains.

if the issue is because of the defaults, switching to a dedicated server block should fix that.

---

<div class="post-metadata">

**Author:** ![0nionboi](https://avatars.discourse-cdn.com/v4/letter/0/6de8d8/32.png) [@0nionboi](https://community.letsencrypt.org/u/0nionboi)\
**Post date:** [March 15, 2021, 10:22pm UTC](https://community.letsencrypt.org/t/letsencrypt-randomly-switching-to-issuing-a-cert-to-the-hostname-instead-of-domain-name/146954/13 "2021-03-15T22:22:07Z")

</div>

> [@schoen](#):
>
> I think the overlap between the virtual hosts defined in `ssl.conf` and `01-brynathyn.oudeve.com-le-ssl.conf` is causing some troubles. Could you post the whole contents of `ssl.conf` ?

I removed the commented out lines.

```
cat /etc/httpd/conf.d/ssl.conf

Listen 443 https

SSLPassPhraseDialog exec:/usr/libexec/httpd-ssl-pass-dialog

SSLSessionCache shmcb:/run/httpd/sslcache(512000)
SSLSessionCacheTimeout 300

SSLRandomSeed startup file:/dev/urandom 256
SSLRandomSeed connect builtin

SSLCryptoDevice builtin

<VirtualHost _default_:443>

ErrorLog logs/ssl_error_log
TransferLog logs/ssl_access_log
LogLevel warn
SSLEngine on
SSLProtocol all -SSLv2 -SSLv3

SSLCipherSuite HIGH:3DES:!aNULL:!MD5:!SEED:!IDEA

SSLCertificateFile /etc/pki/tls/certs/localhost.crt
SSLCertificateKeyFile /etc/pki/tls/private/localhost.key

<Files ~ "\.(cgi|shtml|phtml|php3?)$">
    SSLOptions +StdEnvVars
</Files>
<Directory "/var/www/cgi-bin">
    SSLOptions +StdEnvVars
</Directory>

BrowserMatch "MSIE [2-5]" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0

CustomLog logs/ssl_request_log \
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

</VirtualHost>

```

---

<div class="post-metadata">

**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\
**Post date:** [March 16, 2021, 12:47am UTC](https://community.letsencrypt.org/t/letsencrypt-randomly-switching-to-issuing-a-cert-to-the-hostname-instead-of-domain-name/146954/14 "2021-03-16T00:47:12Z")

</div>

Now I'm confused about how this happens

> [@0nionboi](#):
>
> ` port 443 namevhost s06007.databank.host (/etc/httpd/conf.d/ssl.conf:56)`

if that name isn't mentioned anywhere in that file!

---

<div class="post-metadata">

**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\
**Post date:** [March 16, 2021, 6:50am UTC](https://community.letsencrypt.org/t/letsencrypt-randomly-switching-to-issuing-a-cert-to-the-hostname-instead-of-domain-name/146954/15 "2021-03-16T06:50:04Z")

</div>

> [@schoen](#):
>
> if that name isn't mentioned anywhere in that file!

Probably the servers own hostname:

> If no ServerName is specified, the server attempts to deduce the client visible hostname by first asking the operating system for the system hostname, and if that fails, performing a reverse lookup on an IP address present on the system.

([core - Apache HTTP Server Version 2.4](https://httpd.apache.org/docs/current/mod/core.html#servername))

---

<div class="post-metadata">

**Author:** ![JimPas](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jimpas/32/33270_2.png) [@JimPas](https://community.letsencrypt.org/u/JimPas)\
**Post date:** [March 16, 2021, 10:41pm UTC](https://community.letsencrypt.org/t/letsencrypt-randomly-switching-to-issuing-a-cert-to-the-hostname-instead-of-domain-name/146954/16 "2021-03-16T22:41:21Z")

</div>

> [@Osiris](#):
>
> Probably the servers own hostname:

That's what it is. `s06007` is his server's name on `databank.host`. Going to `s06007.databank.host` serves up the page below (which is not secure).

![image](https://global.discourse-cdn.com/letsencrypt/original/3X/2/0/20ba68a04a4b6bbed8ede8f2568dc8f59aa59bd7.png)

---

<div class="post-metadata">

**Author:** ![0nionboi](https://avatars.discourse-cdn.com/v4/letter/0/6de8d8/32.png) [@0nionboi](https://community.letsencrypt.org/u/0nionboi)\
**Post date:** [March 18, 2021, 7:12pm UTC](https://community.letsencrypt.org/t/letsencrypt-randomly-switching-to-issuing-a-cert-to-the-hostname-instead-of-domain-name/146954/17 "2021-03-18T19:12:41Z")

</div>

I'm confused about how the server name is ending up in my SSL cert. Is that certbot's doing, or Apache?

---

<div class="post-metadata">

**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\
**Post date:** [March 18, 2021, 7:13pm UTC](https://community.letsencrypt.org/t/letsencrypt-randomly-switching-to-issuing-a-cert-to-the-hostname-instead-of-domain-name/146954/18 "2021-03-18T19:13:34Z")

</div>

Apache. If you don't set a `ServerName` directive in `<VirtualHost>` section, Apache will use the hostname of the server. Please see the documentation I linked above.

---

<div class="post-metadata">

**Author:** ![jvanasco](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jvanasco/32/55900_2.png) [@jvanasco](https://community.letsencrypt.org/u/jvanasco)\
**Post date:** [March 18, 2021, 7:52pm UTC](https://community.letsencrypt.org/t/letsencrypt-randomly-switching-to-issuing-a-cert-to-the-hostname-instead-of-domain-name/146954/19 "2021-03-18T19:52:18Z")

</div>

> [@Osiris](#):
>
> If you don't set a `ServerName` directive in `<VirtualHost>` section, Apache will use the hostname of the server. Please see the documentation I linked above.

This is why I think my approach will work. You make a first virtualhost for domain you want, with the explicit server names, and then a second virtualhost/server for the default, which just redirects to the intended domain.

This gets around most servername issues I have encountered.

e.g.

```
<VirtualHost _default_:*>
   # never serve anything but a redirect on the default server
   Redirect / https://www.example.com
</VirtualHost>
<VirtualHost *:443>
    ServerName www.example.com
</VirtualHost>

```

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [April 17, 2021, 7:52pm UTC](https://community.letsencrypt.org/t/letsencrypt-randomly-switching-to-issuing-a-cert-to-the-hostname-instead-of-domain-name/146954/20 "2021-04-17T19:52:55Z")

</div>

Closed on April 17, 2021, 7:52pm UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.