Name based virtual hosts cause NET::ERR_CERT_COMMON_NAME_INVALID

Question

I have the VirtualHost directives in the webserver config files in the following format:

<VirtualHost *:443>
  ServerName example.com

Entering https://example.com to the browser renders the site correctly, traffic is TLS encrypted. As soon as I rewrite it to

<VirtualHost example.com:443>

Firing a GET request to the domain on port 443 results in an SSL error, namely NET::ERR_CERT_COMMON_NAME_INVALID in Chrome, which says, that the webserver provided a certificate that is valid for example.net (this other domain is still hosted on my server).

If I look into the cert (openssl x509 -in cert.pem -text), I get that it's issued for

Subject: CN=example.com

The path to the cert is correctly configured.

Additional info: Both domains resolve to the same 127.0.0.1 in the hosts file, NameVirtualHost is not set, and there is a proxy in front of the webserver, which hopefully has nothing to do with this issue.

Answer 1

Argument to the VirtualHost directive must match a defined NameVirtualHost directive.

You can't use domain.com in the VirtualHost directive if you don't have NameVirtualHost domain.com defined in config, which is something not commonly used, * or IP is generally used for NameVirtualHost.

Since this VirtualHost is not valid, it loads the first or default VirtualHost it exists on that IP for port 443, which is anotherdomain.com whose SSL you are being served.

Answer 2

I had this issue, I previously had my app on an internal QA domain with it's own certificate.

When the domain was updated to it's permanent one, I wanted to set up redirect rules from the old one to the new one.

The fix for me was to define the QA SSL certs in the virtual hosts before redirecting:

#QA VHost
<VirtualHost *:443>
        SSLEngine on
        SSLCertificateFile /etc/ssl/certs/qa/server.crt
        SSLCertificateKeyFile /etc/ssl/certs/qa/server.key
        SSLCACertificateFile /etc/ssl/certs/qa/rsaca.crt


        ServerName qa.internaldomain.com
        Redirect / https://production.com/

</VirtualHost>

And then define the production SSL in the relevant virtual host

# Prod VHost
<VirtualHost *:443>
        ServerName production.com
        DocumentRoot /http/production

        SSLEngine on
        SSLCertificateFile /etc/ssl/certs/production/server.crt
        SSLCertificateKeyFile /etc/ssl/certs/production/server.key
        SSLCACertificateFile /etc/ssl/certs/production/rsaca.crt

        # other vhost configs ...

</VirtualHost>

Obviously this only works if you have a valid cert for the redirecting domain, I guess you could always use a service like certbot if you don't have one.