Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to setup a Geotrust SSL certificate for my Heroku app using the SSL Endpoint addon and the instructions at

I generated my public key from my private key using:

openssl rsa -in server.orig.key -out server.key

and added to the heroku certs:

heroku certs:add server.crt server.key

Everything seemed to be fine. heroku certs listed the corrected information only with Trusted = false for my certificate.

If I go to the browser says:

You attempted to reach,
but instead you actually reached a server identifying itself as

As expected with the certificate apparently identifying the correct domain, but When I set up the CNAME to the given and visit my subdomain the browser says: uses an invalid security certificate.

The certificate is only valid for the following names:
* ,

If I run curl -kv

I get: subjectAltName does not match

share|improve this question
I was wondering because of the Trusted = false result if this was an issue with Intermediate certificates and how that might be rectified? – benedict_w Nov 12 '12 at 10:55
No, it's not an intermediate certificate issue. It's a straight name mismatch. I would go over the steps again, and check to make sure the DNS resolves correctly. – cjc Nov 12 '12 at 11:05
Thanks for your reply I will repeat the process... but it seems strange that the heroku certs information is correct and the certificate seems correct at: – benedict_w Nov 12 '12 at 11:12

I tried the process again, it seems my mistake was in this step:

openssl rsa -in server.orig.key -out server.key

I already had the private key in server.orig.key and didn't need to generate it. I just needed to attache my Geotrust .crt and .key files to the heroku ssl endpoint.

share|improve this answer
Heroku allowed you to submit a cert that didn't match the key?! – cjc Nov 12 '12 at 14:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.