Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

on my server i have multiple virtual hosts with apache2. Some with domain * and some whith * Each domain has it's own wildcard certificate.

When I fetch the certificate via openssl s_client the output is something like that:

$ openssl s_client -connect
[...] CN = *, emailAddress [...]
verify error:num=18:self signed certificate
verify return:1
[...] CN = *, emailAddress [...]
verify return:1
    Verify return code: 18 (self signed certificate)

And with gnutls-cli

$ gnutls-cli -p 443
Processed 164 CA certificate(s).
Resolving ''...
Connecting to ''...
- Certificate type: X.509
- Got a certificate list of 1 certificates.
- Certificate[0] info:
 - subject `[...]CN=*[...]', RSA key 2048 bits, signed using RSA-SHA1, activated `2013-07-11 12:30:31 UTC', expires `2015-07-11 12:30:31 UTC', SHA-1 fingerprint `94ddfd0d74e0352521af511c1d08c71e5314fae4'
- Status: The certificate is NOT trusted. The certificate issuer is unknown. 
*** Verifying server certificate failed...
*** Fatal error: Error in the certificate.
*** Handshake has failed
GnuTLS error: Error in the certificate.

(I've shorted the output by "[...]")

Firefox fetches (as gnutls) the correct certificate...

Why are there differences?

share|improve this question
What are the actual hostnames/ip addresses? I'm guessing it's SNI related, but want to check. – Dennis Kaarsemaker Mar 16 '14 at 10:22 and are on two different servers. Please provide the actual names. – Dennis Kaarsemaker Mar 16 '14 at 10:50
I deleted comment because it was not relevant – nepda Mar 16 '14 at 15:23
up vote 0 down vote accepted

If you use multiple certificates behind the same IP address you have to use SNI (server name indication). While browsers do this by default and gnutls maybe too, the s_client does not and you have to use openssl s_client -servername -connect ...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.