Net::err_cert_common_name_invalid

Help
1

My domain is: example.com (my domain is not published)

I ran this command:

sudo certbot certonly --manual --preferred-challenges dns -d "*.example.com"

It produced this output:

Successfully received certificate.

My web server is (include version):

nginx version: nginx/1.14.1

The operating system my web server runs on is (include version):

NAME="AlmaLinux"
VERSION="8.7 (Stone Smilodon)"
ID="almalinux"
ID_LIKE="rhel centos fedora"
VERSION_ID="8.7"

My hosting provider, if applicable, is:

myself

I can login to a root shell on my machine (yes or no, or I don't know):

yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):

no control panel...SSH

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):

certbot 1.22.0

I got a certificate for the DNS-01 Challenge using the *.example.com format, and everything went well with that. This is the behaviour:

https://www.example.com            # works
https://example.com                # doesn't work
http://example.com                 # doesn't work
example.com                        # doesn't work
www.example.com                    # doesn't work

As by the error code NET::ERR_CERT_COMMON_NAME_INVALID, the attempts that aren't working aren't getting to the nginx.conf directives for a redirect from port 80 to port 443. As seen in the first attempt, port 443 works.

Should I redo the certs using this structure for certtificate generation?

sudo certbot certonly --manual --preferred-challenges dns -d "example.com"

2

Since you are using the ACME DNS-01 Challenge Ports 80 & 443 won't come into play.

What is the context of works and doesn't work?
From certbot?
From an external web browser?

1 Like
3

If you want both www.example.com and example.com to work, then having the wildcard *.example.com alone is insufficient:

*.example.com is NOT valid for example.com

You need to pass both:

-d '*.example.com' -d example.com

4 Likes
4

Ah I see. OK I will redo them. Thank you.

2 Likes
5

Ya from a browser. I am going to redo the certs, given the answer above.

1 Like
6

@BeeRich be aware of the Rate Limits - Let's Encrypt.

7

Why do the HTTP requests fail?
[that has nothing to do with any certificate]
Check the server names/aliases used.

3 Likes
8

Ya I'm good. Thanks

3 Likes
9

I get the same error as posted. The domains I used were *.example.com for example.com, so it seems confused.

10

That error is HTTPS/TLS related.
Why does an HTTP request fail?:

3 Likes
11

I don't know. That's what I'm asking.

12

If HTTP is also failing, then there is more than one problem.
You should have a working HTTP site before trying to secure it.

3 Likes
13

OK, that cert renewal worked great. The server isn't live, and my nginx have a redirect from 80 to 443.

Happy.

3 Likes
14

Happy works for me :wink:

2 Likes
15

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.