1

When visitors try to visit a website of mine, they get this error indicating that the "site is not secure":

Error Code: DLG_FLAGS_SEC_CERT_CN_INVALID

I used the automatic SSL setup certbot from Let's Encrypt.

Any idea what might be causing this?

Is it possible that the issue is that their browsers are caching a previous SSL that is no longer on the domain?

Improve this question
4
  • 1
    Your certificate works fine for me. My guess would be that some of your visitors use outdated browsers that don't have current CAs.
    – Gerald Schneider
    May 24, 2018 at 13:56
  • @GeraldSchneider Awesome, thanks for the response! So the best I would be able to do in this situation is find a more established CA? Because the website is for a client and she says that a lot of her customers (in reality could just be 1 or 2) are getting hit by this.
    – X33
    May 24, 2018 at 14:01
  • On my win8 and IE I got the certificate warning, I guess it's related to IE
    – yagmoth555 ♦
    May 24, 2018 at 14:01
  • Why did you remove the name from your question?
    – Patrick Mevzek
    May 26, 2018 at 16:20

1 Answer 1

Reset to default
4

You forgot to include the www prefix in your certificate request. The cert only works for the domain without www.

See documentation of certbot: https://certbot.eff.org/docs/using.html#changing-a-certificate-s-domains

In the common case of a domain with and without www, you do:

certbot certonly --cert-name example.com -d www.example.com,example.com
Improve this answer
5
  • So I should just simply create an additional certificate for www?
    – X33
    May 24, 2018 at 14:02
  • 1
    @X33 you can maybe just change your cert to include www. and the domain name
    – yagmoth555 ♦
    May 24, 2018 at 14:04
  • The exact operations depend on the service you use to provision the certificate from letsencrypt. I can only refer you to the documentation for certbot.
    – Gerrit
    May 24, 2018 at 14:10
  • Using the documentation you linked, I just ran certbot certonly --cert-name mydomain.com -d www.mydomain.com
    – X33
    May 24, 2018 at 14:12
  • 1
    Caution. You should run certbot certonly --cert-name mydomain.com -d www.mydomain.com,mydomain.com, unless your site can only be reached on www.mydomain.com.
    – Gerrit
    May 24, 2018 at 14:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .