Website giving error in Safari but working fine on Chrome and Firefox

[adityarewari]

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: cashgro.in

I ran this command: http://cashgro.in

It produced this output: screenshot attached
Website may be impersonating

My web server is (include version): Nginx

The operating system my web server runs on is (include version): CentOS

My hosting provider, if applicable, is: Google Domains

I can login to a root shell on my machine (yes or no, or I don't know): Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): No

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 1.11.0

[orangepizza]

your sites cert only valid for www.cashgro.in, not cashgro.in. my firefox errors at first visit

[adityarewari]

This is pretty strange.. as it working fine at Firefox and Chrome both at my Ubuntu machine.

[orangepizza]

looks like there is a wildcard certificate signed today, but webserver isn't using it

[adityarewari]

Yes.. this was done
Earlier the certificate was geenrate for only www.cashgro.in
Now we also wanted to have cashgro.in to be live(and under ssl)

So I used certbot for below domain
cashgro.in
*.cashgro.in

So instead of wild card, should I go for exact domains ?

[orangepizza]

no: using that certificate would be enought but webserver need to be explictly configured to use that

[MikeMcQ]

@adityarewari

This is pretty strange.. as it working fine at Firefox

It fails with "Potential Security Risk" screen on Firefox on my Ubuntu

Maybe you have some cache or something that redirects to your www subdomain?

[adityarewari]

sudo certbot certonly
--manual
--preferred-challenges=dns
--email infra.dev@indepay.com
--server https://acme-v02.api.letsencrypt.org/directory
--work-dir=. --config-dir=. --logs-dir=.
--agree-tos
-d cashgro.in -d www.cashgro.in

I am using this now..(earlier it was *.cashgro.in which is now replaced specifically as www.cashgro.in)

Then I have restarted the Nginx server.. but still the issue persists.
Any worthy suggestion you can add here ?
Thanks

[Osiris]

If you have a functional nginx webserver, why would you use the dns challenge using the --manual for a regular, non-wildcard certificate? Simply using --nginx and without certonly would automate everything for you.

[rg305]

@adityarewari

Any worthy suggestion you can add here ?

Clear your client cache [reboot the phone].

[adityarewari]

I wasnt aware that we have --nginx available.

thanks.. this worked beautifully.