Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I created a self signed signature. I visited my site and saw that it was untrusted (in FF and IE). After accepting it i saw a msg in IE saying it was signed for a different domain. Come to think of it i dont remember ever writing the domain(s) i'll be using this certificate.

I am pretty sure i seen this error elsewhere. How do i self sign a certificate properly?

share|improve this question
up vote 1 down vote accepted

If the CN (Common Name) you use when you create the certificate is different from the name for your website, you will receive errors about it being signed for a different domain.

So, if your site is called

Enter that when asked for the CN during the certificate creation process. That should remove the errors about domain.

It will still complain about it being untrusted though, unless you have it signed by a trusted CA.

share|improve this answer

The hostname of the URL must match the Common Name ("CN") of the Subject of the certificate. When you generate the Certificate Signing Request (CSR), OpenSSL prompts you for the country code, state or province, locality, organization, organizational unit, Common Name, and email address. Be sure to enter the hostname of your server as the Common Name. The CN can also be a wildcard (*

It is also possible to generate a certificate that is valid for multiple discrete hostnames (not a wildcard), in which case the hostname can also match one of the subjectAltNames of the certificate. There are are two ways to create such a certificate with OpenSSL.

The easy way is for the Certificate Authority to put it into the signed certificate. The CA's openssl.cnf needs

[ usr_cert ],

The other way is to put the subjectAltName in the CSR and have the CA honor it. In the requestor's openssl.cnf:

[ v3_req ],

In the CA's openssl.cnf:

[ usr_cert ]

Either way, the generated certificate should be valid for three hostnames (,, and the CN of the subject).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.