Valid Cert error in all browsers

Help
1

Hi,
i have following problem, iam using a lets encrypt certificate for my domain - but if i open up my page in all browsers it says either unknown issuer or untrusted issuer. i checked the cert on various pages like ssllabs.com and they all show no errors, but somehow this occurs

My domain is:https://kiseni.com

My web server is (include version):Microsoft-IIS/10.0

The operating system my web server runs on is (include version): Windows Server 2016 Datacenter

My hosting provider, if applicable, is: Contabo

I can login to a root shell on my machine (yes or no, or I don’t know): Yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel): Plesk Oynx

2

Exactly what certificate and error do you get?

Are you connecting to the right IP address? Maybe it’s set to an older IP in the hosts file, or older DNS records are cached?

1 Like
3

Hi!

I just checked the website in the different browsers, somehow it seems to work now, iam not getting any error anymore, seems like there was something cached.

4

Hi @x1x11x

your configuration is wrong, that's not a caching problem.

Your certificate has only one domain name ( https://check-your-website.server-daten.de/?q=kiseni.com ):

CN=kiseni.com (5145)
	28.03.2019
	26.06.2019
expires in 84 days	kiseni.com - 1 entry

But you have a www dns entry, this isn't secure.

Domainname Http-Status redirect Sec. G
• http://kiseni.com/
173.249.6.221 301 https://kiseni.com/ 0.056 A
• http://www.kiseni.com/
173.249.6.221 301 https://kiseni.com/ 0.050 E
• https://www.kiseni.com/
173.249.6.221 301 https://kiseni.com/ 0.357 N
Certificate error: RemoteCertificateNameMismatch
• https://kiseni.com/
173.249.6.221 200 0.870 B

So if a user uses the www-version, it's wrong. Browsers cache these redirects, so it's not really possible to check that with a browser.

Create one certificate with both domain names, use that.

1 Like
5

Thanks for pointing this out to me!

I’ll do that!

Thank you!

1 Like
6

I renewed the cert in plesk, this time with a www subdomain, but if i check the cert, it says again that the domain name is not matching the cert name - which is still issued for kiseni.com and not www.kiseni.com

Any idea how to fix this?

7

That's only your caching problem.

Rechecked your domain all is good ( https://check-your-website.server-daten.de/?q=kiseni.com ):

Your certificate is new.

CN=kiseni.com
	03.04.2019
	02.07.2019
expires in 90 days	kiseni.com, www.kiseni.com - 2 entries

And both https connections are secure:

Domainname Http-Status redirect Sec. G
• http://kiseni.com/
173.249.6.221 301 https://kiseni.com/ 0.053 A
• http://www.kiseni.com/
173.249.6.221 301 https://kiseni.com/ 0.050 E
• https://www.kiseni.com/
173.249.6.221 301 https://kiseni.com/ 0.363 B
• https://kiseni.com/
173.249.6.221 200 1.570 B
• http://kiseni.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
173.249.6.221 301 https://kiseni.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de 0.053 A
Visible Content: Object Moved This document may be found here
• http://www.kiseni.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
173.249.6.221 301 https://kiseni.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de 0.053 E
Visible Content: Object Moved This document may be found here
• https://kiseni.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de 404 0.777 A
Not Found
Visible Content: Skip to content Menu Primary Menu Home News Status Kiseni Archaeology Software Oops! That page can’t be found. It looks like nothing was found at this location. Maybe try one of the links below or a search? Copyright © 2019 Kiseni . All Rights Reserved. Theme: Full Frame Pro Home News Status

It's only your browser cache. You may modify your redirects, now, it's Grade E, B should be possible.

But both connections are good.

1 Like
8

Now i see!

Thank you very much for your help!

2 Likes
9

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.