2

My VPS contains a dozen or so websites, with several SSL certificate including the following.

  • *.railtrax.com
  • *.insiderarticles.com

Currently, all the *.railtrax.com websites are working fine. But the *.insiderarticles.com website (I only have one) is giving me an error in the browser (note the last paragraph).

Your connection isn't private

Attackers might be trying to steal your information from insiderarticles.com (for example, passwords, messages, or credit cards).

NET::ERR_CERT_COMMON_NAME_INVALID

This server couldn't prove that it's insiderarticles.com; its security certificate is from *.railtrax.com. This may be caused by a misconfiguration or an attacker intercepting your connection.

As you can see, the certificate for insiderarticles.com says it was issued to *.railtrax.com.

Insiderarticles.com Certificate

insiderarticles.com certificate

But I have the correct certificate selected.

Insiderarticles.com Edit Bindings Dialog

insiderarticles.com Edit Bindings dialog

If I use Jexus to run binding diagnostics, I get the following errors:

BINDING: http 74.208.136.116:80:insiderarticles.com
Found a conflicting TCP reserved port range. Please run "netsh int ipv4 show excludedportrange protocol=tcp" at command prompt to troubleshoot.

BINDING: http 74.208.136.116:80:www.insiderarticles.com
Found a conflicting TCP reserved port range. Please run "netsh int ipv4 show excludedportrange protocol=tcp" at command prompt to troubleshoot.

BINDING: https 74.208.136.116:443:insiderarticles.com
Found a conflicting TCP reserved port range. Please run "netsh int ipv4 show excludedportrange protocol=tcp" at command prompt to troubleshoot.

BINDING: https 74.208.136.116:443:www.insiderarticles.com
Found a conflicting TCP reserved port range. Please run "netsh int ipv4 show excludedportrange protocol=tcp" at command prompt to troubleshoot.

And if I run the suggested command, I get the following.

enter image description here

But this isn't helpful to me.

Everything else about the certificates appears valid. I installed the certificate for *.insiderarticles.com and it was working fine. After I installed the certificate for *.railtrax.com, that's most likely when insiderarticles.com stopped working.

Could this have anything to do with the Require Server Name Indication checkbox? This checkbox was checked for insiderarticles.com and unchecked for all the *.railtrax.com websites. I tried checking this option for all the *.railtrax.com websites, but it didn't appear to make any difference.

Can anyone recommend next steps to troubleshoot this?

Improve this question
6
  • It's telling you why the name is invalid. The URL is *.insiderarticles.com, but the cert doesn't match that, and says it's intended for *.railtrax.com . Looks like the wrong cert (insiderarticles) is bound to the wrong site (railtrax), and you need to chain the railtrax cert (and intermediate) to the railtrax site. Either that, or reissue a cert with both values in Subject Alternate Name, if they are related, and chain to both.
    – Dallas
    Nov 13, 2021 at 1:47
  • @Dallas: In the edit bindings dialog, I'm selecting the correct certificates from the drop down. How else could the wrong certificate be associated with the site?
    – Jonathan Wood
    Nov 13, 2021 at 1:56
  • Whatever changes you made in IIS Manager, are saved in Windows HTTP API, docs.jexusmanager.com/tutorials/https-binding.html#background So if something isn't right, follow the principles and check what's wrong.
    – Lex Li
    Nov 13, 2021 at 3:40
  • @LexLi: I installed that tool But I really don't know how it helps me. Was hoping someone who knew the basics about configurating SSL certificates could answer a couple of questions.
    – Jonathan Wood
    Nov 13, 2021 at 17:07
  • I didn't ask you to run binding diagnostics, as that's irrelevant, but pointed you to learn how Windows HTTP API matches incoming HTTPS requests to their corresponding certificates. The answer you accepted below simply says the same though fails to tell the connection to HTTP API.
    – Lex Li
    Nov 16, 2021 at 3:45

3 Answers 3

Reset to default
1

Originally, you could only use a single certificate for an IP:port pair is IIS. This was because host header is not visible during SSL handshake when IIS picks the certificate to be used.

As a solution to this limitation SNI was introduced. It is available in IIS 8 and later and supported by modern browsers (list is here) . You should enable SNI for all web sites, but you might want to have it turned off for a web site which would be used by legacy browsers that do not support SNI. Those legacy browsers would still get SSL certificate name mismatch error.

So your options are one of the following:

  • if legacy browser support is not important, enable SNI for all web sites, except for the one you pick as default for legacy browsers
  • add one more public IP address to your server. Bind each certificate to different IP:port pair
  • purchase a single certificate which can cover both wildcard domains. It is called Multi-Domain Wildcard SSL Certificate or SAN Certificate
Improve this answer
4
  • Thanks, but both certificates are wildcard certificates (you can see the asterisk in the certificate dialog). I do have another, non-wildcard certificate on the site. But that seems to be working fine.
    – Jonathan Wood
    Nov 14, 2021 at 15:05
  • I have updated my answer with more detailed explanation
    – J-M
    Nov 14, 2021 at 16:30
  • Thanks. Does SNI not play any role in all this then?
    – Jonathan Wood
    Nov 14, 2021 at 16:36
  • Sorry, I completely missed this part. Updated my answer
    – J-M
    Nov 14, 2021 at 18:08
1

I'm now thinking that the Require Server Name Indication is the issue.

I indicated I tried checking this option for all my railtrax.com websites and that this made no difference. Looking again today, it appears I missed one. After checking that one, it now seems to be working.

It's possible that something else is at play here. But so far it appears this is the answer. I'm a little surprised more people here didn't seem familiar with this.

Improve this answer
0

I had the same issue. But in my case one of the sites only had bindings to port 80. I had to add a HTTPS binding and then select SNI.

Improve this answer
1
  • As it’s currently written, your answer is unclear. Please edit to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers in the help center.
    – Community Bot
    Apr 27, 2022 at 9:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .