# SSL Test gives back a second certificate **URL:** \ **Category:** Server\ **Created:** [July 24, 2018, 2:20pm UTC](https://community.letsencrypt.org/t/ssl-test-gives-back-a-second-certificate/67519 "2018-07-24T14:20:37Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![DatDraggy](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/datdraggy/32/24960_2.png) [@DatDraggy](https://community.letsencrypt.org/u/DatDraggy)\ **Post date:** [July 24, 2018, 2:20pm UTC](https://community.letsencrypt.org/t/ssl-test-gives-back-a-second-certificate/67519/1 "2018-07-24T14:20:37Z")
Hello, at the moment I’m improving my SSL setup for all my domains. ⛓ I saw here [Incorrect order and Extra certificate error](https://community.letsencrypt.org/t/incorrect-order-and-extra-certificate-error/8759) that I can get help for apache+let’s encrypt issues on this forum. When I used the [ssllabs.com](http://ssllabs.com) test, it says something about a second certificate that my server sent. I have an A+ score, but it still annoys me that my server sends a second certificate for one of my other domains. Example: I tested [isitef.com](https://www.ssllabs.com/ssltest/analyze.html?d=directtest.isitef.com) and when you scroll down you see Certificate #2 which is issued to drgn.li (one of my other domains running on the same server) Why does apache send that second certificate and why is it that domain? I couldn’t find anything in the apache conf and ssl conf. I hope somebody can help me with this. ---
**Author:** ![stevenzhu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stevenzhu/32/18864_2.png) [@stevenzhu](https://community.letsencrypt.org/u/stevenzhu)\ **Post date:** [July 24, 2018, 2:23pm UTC](https://community.letsencrypt.org/t/ssl-test-gives-back-a-second-certificate/67519/2 "2018-07-24T14:23:09Z")
Hi, > [@DatDraggy](#): > > Example: I tested [isitef.com](https://www.ssllabs.com/ssltest/analyze.html?d=directtest.isitef.com) and when you scroll down you see Certificate #2 which is issued to drgn.li (one of my other domains running on the same server) That means you are using SNI, and drgn.li is your primary site on that IP. In order to remove that, configture one site (https / to) on each IP... > [@DatDraggy](#): > > Why does apache send that second certificate and why is it that domain? I couldn’t find anything in the apache conf and ssl conf. Apache identify SNI primary certificate based on the alphabetical order of vHosts. Thank you ---
**Author:** ![DatDraggy](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/datdraggy/32/24960_2.png) [@DatDraggy](https://community.letsencrypt.org/u/DatDraggy)\ **Post date:** [July 24, 2018, 2:24pm UTC](https://community.letsencrypt.org/t/ssl-test-gives-back-a-second-certificate/67519/3 "2018-07-24T14:24:25Z")
> [@stevenzhu](#): > > That means you are using SNI, and drgn.li is your primary site on that IP. Ohhh okay... I'm hosting from home, so unique IPs are not gonna be possible. Thanks for the super fast reply! ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [July 24, 2018, 2:27pm UTC](https://community.letsencrypt.org/t/ssl-test-gives-back-a-second-certificate/67519/4 "2018-07-24T14:27:07Z")
Hi @DatDraggy > [@DatDraggy](#): > > Example: I tested [isitef.com](https://www.ssllabs.com/ssltest/analyze.html?d=directtest.isitef.com) and when you scroll down you see Certificate #2 which is issued to drgn.li (one of my other domains running on the same server) this isn't really a problem. Your site uses SNI. But SSLLabs tests what happens, if your browser doesn't understand SNI. > Certificate #2: RSA 2048 bits (SHA256withRSA) No SNI Theoretical, you can create a certificate with all of your domain names and send this with your default configuration. ---
**Author:** ![DatDraggy](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/datdraggy/32/24960_2.png) [@DatDraggy](https://community.letsencrypt.org/u/DatDraggy)\ **Post date:** [July 24, 2018, 2:29pm UTC](https://community.letsencrypt.org/t/ssl-test-gives-back-a-second-certificate/67519/5 "2018-07-24T14:29:14Z")
Hello @JuergenAuer > [@JuergenAuer](#): > > Theoretical, you can create a certificate with all of your domain names and send this with your default configuration. Yes, that was my old setup, but because I also host domains for friends I decided it would be better to seperate these certificates so that people can't just look in the certificate and figure out what domains I have directing to my server. Thank you both for the replies. ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [July 24, 2018, 2:31pm UTC](https://community.letsencrypt.org/t/ssl-test-gives-back-a-second-certificate/67519/6 "2018-07-24T14:31:02Z")
> [@DatDraggy](#): > > I decided it would be better to seperate these certificates so that people can’t just look in the certificate and figure out what domains I have directing to my server. Yes, because of this I wouldn't do that. 😉 ---
**Author:** ![DatDraggy](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/datdraggy/32/24960_2.png) [@DatDraggy](https://community.letsencrypt.org/u/DatDraggy)\ **Post date:** [July 24, 2018, 2:32pm UTC](https://community.letsencrypt.org/t/ssl-test-gives-back-a-second-certificate/67519/7 "2018-07-24T14:32:48Z")
> [@JuergenAuer](#): > > Yes, because of this I wouldn’t do that. 😉 I thought so as well. Well, drgn.li is only a URL shortener that doesn't even work correctly anymore, so it's not too bad, 😆 ---
**Author:** ![tob](https://avatars.discourse-cdn.com/v4/letter/t/a88e57/32.png) [@tob](https://community.letsencrypt.org/u/tob)\ **Post date:** [July 24, 2018, 7:34pm UTC](https://community.letsencrypt.org/t/ssl-test-gives-back-a-second-certificate/67519/8 "2018-07-24T19:34:27Z")
Too late… People can just look at the old certificates: [https://crt.sh/?id=81220599](https://crt.sh/?id=81220599) ---
**Author:** ![stevenzhu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stevenzhu/32/18864_2.png) [@stevenzhu](https://community.letsencrypt.org/u/stevenzhu)\ **Post date:** [July 24, 2018, 7:57pm UTC](https://community.letsencrypt.org/t/ssl-test-gives-back-a-second-certificate/67519/9 "2018-07-24T19:57:18Z")
But most people won’t care / don’t know where to look… ---
**Author:** ![DatDraggy](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/datdraggy/32/24960_2.png) [@DatDraggy](https://community.letsencrypt.org/u/DatDraggy)\ **Post date:** [July 24, 2018, 8:11pm UTC](https://community.letsencrypt.org/t/ssl-test-gives-back-a-second-certificate/67519/10 "2018-07-24T20:11:34Z")
Yea that’s fine. Not like there’s some weird xxx or other shady site in there so I don’t mind **that** much ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [August 23, 2018, 8:11pm UTC](https://community.letsencrypt.org/t/ssl-test-gives-back-a-second-certificate/67519/11 "2018-08-23T20:11:37Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.