Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The SSL certificate on menswearireland.com and on www.menswearireland.com works fine on Safari, Chrome, SeaMonkey, K-Meleon, QtWeb, Firefox, and Opera. However, Internet Explorer claims that there is an error:

The security certificate presented by this website was not issued by a trusted certificate authority. The security certificate presented by this website was issued for a different website's address.

Security certificate problems may indicate an attempt to fool you or intercept any data you send to the server.

Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0)

Another site hosted on the same managed server shows no errors: achill-fieldschool.com and www.achill-fieldschool.com work fine on IE, even though as far as I can tell the certificate is set up identically.

What am I doing wrong?

This is a LAMPP server running Plesk.

It looks like the server is showing different certificates to different clients. To some clients it shows a RapidSSL certificate made out to www.menswearireland.com with menswearireland.com as a valid alternative name. To other clients, it shows a Parallels Panel certificate, made out to Parallels Panel. Here are results from a few different online SSL checkers: most say it's fine, while two show errors.

Three online checkers say it's valid

Comodo SSL Check shows it as valid

Comodo SSL Check shows it as valid

DigiCert SSL Check shows it as valid

DigiCert SSL Check shows it as valid

SSL Shopper SSL Check shows it as valid

SSL Shopper SSL Check shows it as valid

Common name: www.menswearireland.com
SANs: www.menswearireland.com, menswearireland.com
Valid from October 2, 2012 to November 4, 2013
Serial Number: 559425 (0x88941)
Signature Algorithm: sha1WithRSAEncryption
Issuer: RapidSSL CA

Another online checker seems to see a completely different certificate

GeoCerts SSL Check shows it as invalid

GeoCerts SSL Check shows it as invalid

Common name: Parallels Panel
Organization: Parallels
Valid from August 15, 2012 to August 15, 2013
Issuer: Parallels Panel

Another online checker sees more than one certificate

Symantic SSL Check shows it as invalid

Symantic SSL Check shows it as invalid

The certificate installation checker connected to the Web server and read its certificates, but could not determine which is the primary certificate for the Web server.

Incidentally, on both menswearireland.com and achill-fieldschool.com the homepage will redirect from HTTPS to HTTP. To see SSL details, visit the page /account on both (that page will redirect from HTTP to HTTPS).


I’ve found more information in a more detailed online SSL checker.

https://www.ssllabs.com/ssltest/analyze.html?d=menswearireland.com

This site works only in browsers with SNI support

My understanding is that SNI (RFC 6066) is a method for putting many SSL sites on one shared IP address and port. This does not work on Internet Explorer on older versions of Windows (this has to do with the version of Windows, not the version of Internet Explorer). However, all our SSL sites are on a unique IP address, so we shouldn’t need SNI.

share|improve this question
    
I'd guess you are using Parallels? Sounds like the Parallels Panel self-signed cert installed is interfering with that domain, possibly installed on the same IP? –  TheCleaner Nov 19 '12 at 16:47

2 Answers 2

up vote 3 down vote accepted

So it turns out that in Plesk 11.0 it isn't enough to assign an SSL cert with a website on a dedicated IP address. You also have to go to the list of IP addresses (Server Management > Tools and Settings > Tools & Resources > IP Addresses) and set the "Default site" for each IP address to be the site on that address.

If you don't do that, Plesk serves the cert in a manner which requires SNI, which rather obviates the benefits of putting each secured site on a dedicated IP address in the first place.

You can also set the SSL cert there, but that is unnecessary. This seems to be more confusing than necessary.

share|improve this answer
    
Glad you resolved this. Please be sure to mark your answer as accepted when you are able. –  jscott Dec 18 '12 at 21:03
    
As soon as I read this I guess it was SNI related, given that IE doesn't support it when all the other browsers do. –  Mark Henderson Dec 19 '12 at 0:45
    
And this is still the case in Plesk 12. Your answer just saved my day! –  John Dec 2 at 2:23

When I accessed the website https://www.menswearireland.com from my company LAN (firewall proxy and all) I got an SSL error:

VERIFY DENY: depth=0, (18) self signed certificate: "Parallels Panel"
VERIFY DENY: depth=0, CommonName "Parallels Panel" does not match         
URL "www.menswearireland.com"

This would mean that the certificate is apparently a self-signed certificate and that's a big NO GO for Internet Explorer.

share|improve this answer
    
There's a RapidSSL cert on that, working fine on all other browsers, and showing up on the SSL Checker. So why on Earth is a different cert being served to IE and to you? –  TRiG Nov 16 '12 at 12:43
    
I've updated the question with some extra information. I'm very confused now. –  TRiG Nov 16 '12 at 13:12
    
@TRiG I would be too. So both sites are hosted on the same LAMP instance? Or are these two different physical/virtual servers? –  hot2use Nov 16 '12 at 13:35
    
@TRiG I get two different IP addresses for the two domains, but that could be that your LAMP server picks up the call on both IP addresses. –  hot2use Nov 16 '12 at 13:38
    
@TRiG When I accessed the newly mentioned site www.achill-fieldschool.com via HTTPS / SSL, I didn't get a response at all. The website was displayed without HTTPS/SSL. –  hot2use Nov 16 '12 at 14:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.