# SSL Report : Certificate name mismatch

**URL:** <https://community.letsencrypt.org/t/ssl-report-certificate-name-mismatch/65395>\
**Category:** Help\
**Created:** [June 27, 2018, 3:51pm UTC](https://community.letsencrypt.org/t/ssl-report-certificate-name-mismatch/65395 "2018-06-27T15:51:26Z")\
**Posts on this page:** 19\
**Page:** 1

<div class="post-metadata">

**Author:** ![kameleon1er](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/kameleon1er/32/20344_2.png) [@kameleon1er](https://community.letsencrypt.org/u/kameleon1er)\
**Post date:** [June 27, 2018, 3:51pm UTC](https://community.letsencrypt.org/t/ssl-report-certificate-name-mismatch/65395/1 "2018-06-27T15:51:26Z")

</div>

**Debian Server: Jessie 4.5.7**  
**Apache: 2.4**

Hello, I have a funny problem:  
I have **2 domains at my Hoster: OVH** that point to my machine:

- **1) [Lucifart.com](http://Lucifart.com)**
- **2) [Kameleon.fr](http://Kameleon.fr)**  
I created a certificate for [Lucifart.com](http://Lucifart.com) = OK!  
But for [kameleon.fr](http://kameleon.fr) it points to [Lucifart.com](http://Lucifart.com) when I do a configuration test with:

> Blockquote "[SSL Server Test: kameleon.fr (Powered by Qualys SSL Labs)](Https://www.ssllabs.com/ssltest/analyze.html?d=kameleon.fr)" = "Certificate name mismatch"

Yet I have 1 Vhost for each domain.

Do you have an idea ? And if I made a bad configuration LetsEncrypt for [Kameleon.fr](http://Kameleon.fr), how can I delete the certificate to simply extend that of [Lucifart.com](http://Lucifart.com)?

Thank you.

---

<div class="post-metadata">

**Author:** ![stevenzhu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stevenzhu/32/18864_2.png) [@stevenzhu](https://community.letsencrypt.org/u/stevenzhu)\
**Post date:** [June 27, 2018, 5:00pm UTC](https://community.letsencrypt.org/t/ssl-report-certificate-name-mismatch/65395/2 "2018-06-27T17:00:54Z")

</div>

Hi,

It seems that you could use two setups,

1. Add another vHost listening to 443 for [kameleon.fr](http://kameleon.fr), set the certificate you got from certbot to this vHost,then the [kameleon.fr](http://kameleon.fr) or the other might show "need SNI" for ssltest. (But that's fine)
2. Add another vHost listening 443 for [kameleon.fr](http://kameleon.fr), extend the current certificate for [lucifart.com](http://lucifart.com) to include [kameleon.fr](http://kameleon.fr) and set the included certificate to this vHost (however you'll still need to use SNI if both site are serving different content)

> [@kameleon1er](#):
>
> how can I delete the certificate to simply extend that of [Lucifart.com](http://Lucifart.com)?

Just run `certbot delete` (to delete the old certificate), then `certbot --expand`(to expand the current certificate)

Thank you

---

<div class="post-metadata">

**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\
**Post date:** [June 27, 2018, 5:02pm UTC](https://community.letsencrypt.org/t/ssl-report-certificate-name-mismatch/65395/3 "2018-06-27T17:02:34Z")

</div>

> [@stevenzhu](#):
>
> then `certbot --expand` (to expand the current certificate)

... specifying _all_ of the names with `-d` options in a single Certbot command.

---

<div class="post-metadata">

**Author:** ![kameleon1er](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/kameleon1er/32/20344_2.png) [@kameleon1er](https://community.letsencrypt.org/u/kameleon1er)\
**Post date:** [June 27, 2018, 8:45pm UTC](https://community.letsencrypt.org/t/ssl-report-certificate-name-mismatch/65395/4 "2018-06-27T20:45:47Z")

</div>

Thanks guys, I’ll make tests tomorrow 🙂

---

<div class="post-metadata">

**Author:** ![kameleon1er](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/kameleon1er/32/20344_2.png) [@kameleon1er](https://community.letsencrypt.org/u/kameleon1er)\
**Post date:** [June 28, 2018, 2:08pm UTC](https://community.letsencrypt.org/t/ssl-report-certificate-name-mismatch/65395/5 "2018-06-28T14:08:44Z")

</div>

Hi,  
I'm not sure I understand the command " **delete**". I go to : **/etc/letsencrypt/live** and I run the command but I get an error ;

> argument --cert-path is required

Maybe a dumb question 🤪, but what does it mean "cert-path" ? Do I need to indicate the complete path to my cert ? Thx

---

<div class="post-metadata">

**Author:** ![stevenzhu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stevenzhu/32/18864_2.png) [@stevenzhu](https://community.letsencrypt.org/u/stevenzhu)\
**Post date:** [June 28, 2018, 5:17pm UTC](https://community.letsencrypt.org/t/ssl-report-certificate-name-mismatch/65395/6 "2018-06-28T17:17:00Z")

</div>

Yes… (My bad)

You will first need to run `certbot certificates`, find the certificate you want to delete, record the path for that (the full chain one). Then run `certbot delete --cert-path [your cert path]`

---

<div class="post-metadata">

**Author:** ![kameleon1er](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/kameleon1er/32/20344_2.png) [@kameleon1er](https://community.letsencrypt.org/u/kameleon1er)\
**Post date:** [June 28, 2018, 5:30pm UTC](https://community.letsencrypt.org/t/ssl-report-certificate-name-mismatch/65395/7 "2018-06-28T17:30:11Z")

</div>

I'm still very confusing, certbot always return error " `certbot: error: unrecognized arguments: --cert-name lucifart.com` "  
Do I have an old version of LetsEncrypt ? How can I know ? What is strange, if I run :

> renew --dry-run

it works. Many errors, but works.

Thanks.

---

<div class="post-metadata">

**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\
**Post date:** [June 28, 2018, 5:40pm UTC](https://community.letsencrypt.org/t/ssl-report-certificate-name-mismatch/65395/8 "2018-06-28T17:40:16Z")

</div>

Maybe. What does “`certbot --version`” say?

If it’s version 0.10.2 from jessie-backports, it’s too old. You could use certbot-auto, or use `rm` to delete certificates.

I’m not sure you **do** need to delete any certificates, though.

---

<div class="post-metadata">

**Author:** ![kameleon1er](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/kameleon1er/32/20344_2.png) [@kameleon1er](https://community.letsencrypt.org/u/kameleon1er)\
**Post date:** [June 28, 2018, 5:49pm UTC](https://community.letsencrypt.org/t/ssl-report-certificate-name-mismatch/65395/9 "2018-06-28T17:49:12Z")

</div>

> [@mnordhoff](#):
>
> certbot --version

certbot 0.8.1

Mmm… I need an update.

---

<div class="post-metadata">

**Author:** ![kameleon1er](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/kameleon1er/32/20344_2.png) [@kameleon1er](https://community.letsencrypt.org/u/kameleon1er)\
**Post date:** [June 29, 2018, 11:18am UTC](https://community.letsencrypt.org/t/ssl-report-certificate-name-mismatch/65395/10 "2018-06-29T11:18:11Z")

</div>

Hi guys, back to the front 🙂 !!

Certbot updated !! Peace of cake to delete my old certs 😋 Great job LetsEncrypters, really easiest to understand.

Thanks a lot.

---

<div class="post-metadata">

**Author:** ![kameleon1er](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/kameleon1er/32/20344_2.png) [@kameleon1er](https://community.letsencrypt.org/u/kameleon1er)\
**Post date:** [June 29, 2018, 7:05pm UTC](https://community.letsencrypt.org/t/ssl-report-certificate-name-mismatch/65395/11 "2018-06-29T19:05:44Z")

</div>

One more Hi 🙂  
My cert is ok now, thanks, and I cleaned up orphans too.

But I've a specific question because I'm using WordPress MU ;

- my main site (attached to my domain) display well the green padlock, but when I switch to my sub-site (sub-directory configuration ; **/domaine/sub-site** , my adress is also https but no padlock anymore.

I tried plugin to try to fix mixed-content, but nothing change.

And I would prefer a non-plugin solution. Maybe htaccess/Apache re-write approche ?

Certbot has propose 2 options :

> ## Please choose whether HTTPS access is required or optional.
> 
> 1: Easy - Allow both HTTP and HTTPS access to these sites  
> 2: Secure - Make all requests redirect to secure HTTPS access

But I choose the first one during installation. I don't know if I can rollback.

I know now, it could be easier if I had chosen "sub-domain" installation.

If anybody have an idea 🙂

Thanks.

---

<div class="post-metadata">

**Author:** ![stevenzhu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stevenzhu/32/18864_2.png) [@stevenzhu](https://community.letsencrypt.org/u/stevenzhu)\
**Post date:** [June 29, 2018, 7:08pm UTC](https://community.letsencrypt.org/t/ssl-report-certificate-name-mismatch/65395/12 "2018-06-29T19:08:57Z")

</div>

Hi,

In that case, can you share us an example? (Usually it’s die to the MU background set to http instead of https…or using drag and drop builder like breaver builder which will not update to https when site address changed.)

---

<div class="post-metadata">

**Author:** ![kameleon1er](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/kameleon1er/32/20344_2.png) [@kameleon1er](https://community.letsencrypt.org/u/kameleon1er)\
**Post date:** [June 29, 2018, 7:14pm UTC](https://community.letsencrypt.org/t/ssl-report-certificate-name-mismatch/65395/13 "2018-06-29T19:14:25Z")

</div>

So quick answer @stevenzhu 🙂

Yes : [kameleon.fr](http://kameleon.fr) main site (my work) and [Kameleon.fr (my shop)](http://kameleon.fr/shop)

Everything is working for the moment, admin et front. But for a Shop, not really cool to not have a padlok.

---

<div class="post-metadata">

**Author:** ![stevenzhu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stevenzhu/32/18864_2.png) [@stevenzhu](https://community.letsencrypt.org/u/stevenzhu)\
**Post date:** [June 29, 2018, 7:29pm UTC](https://community.letsencrypt.org/t/ssl-report-certificate-name-mismatch/65395/14 "2018-06-29T19:29:59Z")

</div>

Hi,

Please take a look at this page (a full analysis of that page)  
[https://www.whynopadlock.com/results/2e70931a-a5f6-47eb-bdcc-1f8f15bf5836](https://www.whynopadlock.com/results/2e70931a-a5f6-47eb-bdcc-1f8f15bf5836)

There’s a simple fix…  
Move all your http configs to https then set 301 redirect from http to https (aka always on https)

Then reboot apacje server & refresh browser cache.

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [June 29, 2018, 7:39pm UTC](https://community.letsencrypt.org/t/ssl-report-certificate-name-mismatch/65395/15 "2018-06-29T19:39:27Z")

</div>

> [@kameleon1er](#):
>
> But for a Shop, not really cool to not have a padlok.

Use Chrome or FireFox (Desktop), then

CTRL + Shift + I

then open the console. There you can find all errors.

---

<div class="post-metadata">

**Author:** ![kameleon1er](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/kameleon1er/32/20344_2.png) [@kameleon1er](https://community.letsencrypt.org/u/kameleon1er)\
**Post date:** [June 29, 2018, 7:48pm UTC](https://community.letsencrypt.org/t/ssl-report-certificate-name-mismatch/65395/16 "2018-06-29T19:48:38Z")

</div>

I thought I did it, but ok, I will read the page and verify 😉 I read a lot these days, I’m loosing my french 🙂 Thanks Steven.  
Best regards.

---

<div class="post-metadata">

**Author:** ![kameleon1er](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/kameleon1er/32/20344_2.png) [@kameleon1er](https://community.letsencrypt.org/u/kameleon1er)\
**Post date:** [June 29, 2018, 7:49pm UTC](https://community.letsencrypt.org/t/ssl-report-certificate-name-mismatch/65395/17 "2018-06-29T19:49:23Z")

</div>

Thanks Juergen, I wiil do 🙂

---

<div class="post-metadata">

**Author:** ![jputterg](https://avatars.discourse-cdn.com/v4/letter/j/58f4c7/32.png) [@jputterg](https://community.letsencrypt.org/u/jputterg)\
**Post date:** [July 3, 2018, 2:52pm UTC](https://community.letsencrypt.org/t/ssl-report-certificate-name-mismatch/65395/18 "2018-07-03T14:52:11Z")

</div>

I run a server that supplies hosting for about 20 wordpress sites. I decided that it was better to issue a certificate for each site.  
Then to control the site through their separate virtual host configurations

This is my virtualhost conf file … as you see I do my rewrite rules inside the apache file rather than a htaccess file. I found I needed this line in the ssl conf for the site to stop getting SNI errors SSLStrictSNIVHostCheck off.

There are very few browsers around without SNI support today.

\<VirtualHost \*:80\>  
UseCanonicalName Off  
ServerAdmin [admin@example.org](mailto:admin@example.org)  
ServerAlias [www.example.org](http://www.example.org)  
ServerName [example.org](http://example.org)  
#If you want to force https remove the hash from the following line  
Redirect permanent / [https://example.org](https://example.org)

# 

VirtualDocumentRoot /var/www/html/example.org/  
DirectoryIndex index.php  
Options All

```
    RewriteEngine On
    RewriteRule ^/wp-admin/$ /wp-admin/index\.php [R=301,L]
    RewriteRule ^/uploads/(.*)$ /var/www/html/example.org/wp-content/uploads/$1 [L,NC]
    RewriteRule ^/wp-content/uploads/(.*)$ /var/www/html/example.org/wp-content/uploads/$1 [L]
    RewriteRule ^/wp-content/(.*)$ /var/www/html/example.org/wp-content/$1
    RewriteRule ^index\.php$ - [L]

```

# For permalinks to work

```
    RewriteCond /var/www/html/example.org/%{REQUEST_URI} !-f
    RewriteCond /var/www/html/example.org/%{REQUEST_URI} !-d
    RewriteRule . /var/www/html/example.org/index.php [L]

```

#In case permalinks dont work … according to Debian Wiki  
  
Options FollowSymLinks  
AllowOverride All  
Require all granted

#CustomLog /var/log/apache2/access.log vhost\_combined  
#Switch these on and turn the above setting off if there are problems  
CustomLog /var/log/apache2/example.org-access.log common  
ErrorLog /var/log/apache2/example.org-error.log

# this is needed when activating multisite, WP needs to to a

# fopen(“[http://randomname.domain.com](http://randomname.domain.com)”) to verify

# that apache is correctly configured

php\_admin\_flag allow\_url\_fopen on

\<VirtualHost \*:443\>  
UseCanonicalName Off  
ServerAdmin [admin@example.org](mailto:admin@example.org)  
ServerAlias [www.example.org](http://www.example.org)  
ServerName [example.org](http://example.org)  
SSLEngine On  
SSLCertificateFile /etc/letsencrypt/live/example.org/cert.pem  
SSLCertificateKeyFile /etc/letsencrypt/live/example.org/privkey.pem  
Include /etc/letsencrypt/options-ssl-apache.conf  
SSLCertificateChainFile /etc/letsencrypt/live/example.org/fullchain.pem  
SSLStrictSNIVHostCheck off

VirtualDocumentRoot /var/www/html/example.org/  
DirectoryIndex index.php  
Options All

```
    RewriteEngine On
    RewriteRule ^/wp-admin/$ /wp-admin/index\.php [R=301,L]
    RewriteRule ^/uploads/(.*)$ /var/www/html/example.org/wp-content/uploads/$1 [L,NC]
    RewriteRule ^/wp-content/uploads/(.*)$ /var/www/html/example.org/wp-content/uploads/$1 [L]
    RewriteRule ^/wp-content/(.*)$ /var/www/html/example.org/wp-content/$1
    RewriteRule ^index\.php$ - [L]

```

# For permalinks to work

```
    RewriteCond /var/www/html/example.org/%{REQUEST_URI} !-f
    RewriteCond /var/www/html/example.org/%{REQUEST_URI} !-d
    RewriteRule . /var/www/html/example.org/index.php [L]

```

#In case permalinks dont work … according to Debian Wiki  
  
Options FollowSymLinks  
AllowOverride All  
Require all granted

#CustomLog /var/log/apache2/access.log vhost\_combined  
##In case of problems use the following logs instead  
CustomLog /var/log/apache2/example.org-access.log common  
ErrorLog /var/log/apache2/example.org-error.log

## this is needed when activating multisite, WP needs to to a

## fopen(“[http://randomname.domain.com](http://randomname.domain.com)”) to verify

## that apache is correctly configured

#php\_admin\_flag allow\_url\_fopen on

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [August 2, 2018, 2:52pm UTC](https://community.letsencrypt.org/t/ssl-report-certificate-name-mismatch/65395/19 "2018-08-02T14:52:15Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.