This is probably not the site you were looking for error

Question

One of our clients receives this error when attempting to access our app. The error message is:

"You attempted to reach xxx.foo.com, but instead you actually reached a server identifying itself as yyy.bar.com. This may be caused by a misconfiguration on the server or by something more serious ... "

The only request in our application that goes to yyy.bar.com is a javascript file in our header (format: https://yyy.bar.com/script.js).

I have been unable to duplicate this issue locally, and no other users are reporting this issue. I'm convinced it is a setting on the client's machine, but after trolling around in Chrome's content settings/certificate management pages, I am unable to figure out what might be causing this to only happen to one specific client.

(Note, all of the client's machines are affected. Maybe its some antivirus configuration, or a problem with their router?)

Answer 1

They're running Chrome on Windows XP, which doesn't support SSL SNI when running on XP because it uses the MS crypto library. It'll reproduce in that situation (or with IE on XP, as well).

For working clients, they're accessing a resource within https://xxx.foo.com and, because they support SNI, they're getting the xxx.foo.com cert presented by the web server.

For this Windows XP client, it's requesting a resource from https://xxx.foo.com and getting the default certificate for that SSL port; the yyy.foo.com cert, which is invalid for that name.

What's your web server, and how are its SSL listeners configured?

Answer 2

Use PORT or IP based virtual hosting. HOSTNAME based virtual hosting is not compatible with using SSL on both hosts.