Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've had an SSL certificate installed for my Tomcat web application for the past year, running just fine. As the certificate is expiring, I needed to replace it. I went through the usual channels, generated a new CRT, and got a replacement certificate from GoDaddy (the certificate provider).

I then created a new keystore using my certificate and the root, cross, and intermediate certs provided by GoDaddy. I noted that when the keystore was complete, 3 of the 4 entries were identical to the existing, working keystore on the live site (although the listing order of the cross and intermed certs were reversed; does that matter?). The one entry that was different was my own, new certificate--which makes sense. This was all very encouraging.

Nonetheless, when I installed the new keystore on my webapp's site, I got an Untrusted Certificate Warning from the browser when I tried to access my site. When I called GoDaddy tech support about this, the rep said that it's because I have two outstanding certificates on the same site and that the warning will go away when the old one expires next week. I am highly dubious of this theory, and if it's incorrect, then I will be left the morning of without a properly functioning cert and no ideas on how to fix it.

What could be the real reason behind the Untrusted Cert warning?

share|improve this question

migrated from stackoverflow.com Jul 18 '10 at 1:51

This question came from our site for professional and enthusiast programmers.

1 Answer 1

up vote 0 down vote accepted

The problem ended up being that I when I entered the domain name for the Distinguished Name information while generating the key, I used an asterisk, e.g.: *.myserver.com, thinking this would cover me for myserver.com, www.myserver.com, etc. However, the asterisk is only appropriate for "wildcard" certificates, which I apparently don't have.

So I regenerated the key using just "myserver.com", and it worked just fine. And for some reason it still works for both "myserver.com" and "www.myserver.com".

Incidentally, this site was very helpful to me in diagnosing this problem:

http://www.sslshopper.com/ssl-checker.html

share|improve this answer
    
The reason it works is that most likely you have Subject Alternate Name extension on the certificate that lists both myserver.com and www.myserver.com. A lot of CAs do this when issuing certificates. –  Nasko Jul 23 '10 at 16:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.