Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have this issue with one of our websites. I recently purchased and updated and SSL certificate, installed on our server, running IIS 6.0:

enter image description here

Now, every time someone goes to our site, we get this (typical) error:

enter image description here

However, when you click on the certificate itself, it says it's valid:

enter image description here

I am at a loss here. I tested it in IE, Firefox and Chrome, to the same result. The SSL certificate is issue to a proper address, btw. Any ideas?

share|improve this question
    
Not enough information to go on. Is this server with a hosting company? If so, they always have some form of an SSL installation document. The certificate is clearly installed wrong. You need to talk with your hosting company and see what is wrong if that is the case. –  Techie Joe Jul 3 '13 at 23:42

1 Answer 1

up vote 1 down vote accepted

The error in the screenshot indicates not that the certificate itself is invalid or cannot be validated or is installed wrong, but rather that the host part of the URI (eg. the DNS name or the IP address if the IP address was entered to access the site) does not match the subject CN (canonical name) or a SAN (subject alternative name) in the certificate. Alas, you've blanked out all the information that would help isolate why exactly this is happening in your case, but it is easy to explain in general terms.

If a certificate is issued for www.example.tld, and the site is accessed using https://example.tld, the certificate will not validate. The inverse is also true: if it is issued for example.tld, it will not validate when presented to verify https://www.example.tld.

One solution to overcome this is the SAN field. This allows you to specify multiple names for which the certificate is valid, so that you can present it for each domain and subdomain you specify. However, if the name isn't mentioned in the certificate (or the user agent is horribly out of date and doesn't understand SANs), the certificate is invalid.

Wildcard certificates are a second solution to this problem. They will validate for all subdomains of a domain. For example, www.example.com, example.com, and mail.example.com can all validly present a certificate with a subject CN of example.com with a SAN *.example.com.

The IP address of a site can also be the subject CN or an SAN for a certificate, allowing your SSL certificate to be valid even when a site is accessed with something like https://192.0.2.1/. It is rare that providers will do this, and none will do it unless the IP address is recorded as being assigned to you or your organization (and not your ISP) in the appropriate RIR records or at least the WHOIS records as delegated.

One of these things will be the reason the certificate you presented is not the right one.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.