I’m using a control panel to manage my site (no, or provide the name and version of the control panel): cPanel
I installed my certificate via the Let’s Encrypt cPanel app a while ago and all was OK until yesterday when I noticed an error getting to my site.
When I checked the certificate, the domain listed was for ‘317artists.com’ - and not my domain. I have just noticed via a ‘whois’ check, that the domain 317artists.com is using the same name servers as siteground, but that shouldn’t really cause this issue, should it?
Does anyone know how this has happened? Does it mean there’s a security compromise somewhere, is it an issue with siteground or let’s encrypt?
Siteground have removed the certificate and the site is now accessed with no certificate until we can get another one installed.
I did some more checks and not only is 317artists.com another Siteground customer, but their site is actually hosted on the same server as yours.
Indeed, not only is their site hosted on the same server, but it is configured as the default certificate to send when the client doesn’t request a specific host name, and also when the client requests a host name for which the server doesn’t have a certificate configured.
So what you’re seeing is a fallback behavior when the server, for some reason, no longer knows about the certificate to use for your site, and instead presents a default one, which is the certificate of a particular other customer who was hosted on the same server. It would have been less confusing if Siteground had configured their own certificate as the default, but I guess they didn’t expect this particular situation to come up in practice.
This could be the result of a software bug in Siteground’s deployment code, or even an internal process error, like if a Siteground employee accidentally deleted or deactivated your certificate for some reason.