We've been using a GeoTrust SSL certificate, for some time now, and I just got a call that Internet Explorer warns its users that our certificate is not trusted. I really have no clue what's going on.

We're using nginx 1.0.5, I've installed the certificate along with the GeoTrust intermediary and it works absolutely fine in Firefox, Safari and Google Chrome, etc.

Additionally a digicert SSL check tells me everything is okay. However, Internet Explorer 8 and another SSL checker both tell me, that:

  1. It's not trusted (self-signed)
  2. The domain name doesn't match.

What is going on?

A few details on our setup: We're running a Rails app with nginx + unicorn (as rack server), nginx as reverse proxy to unicorn, and serving static assets.

We have basically three virtual hosts:

  1. production - containing of a http and a https virtual host
  2. staging - exact copy of production, but on another subdomain, and different SSL cert (self-signed)
  3. a 'rewrite' virtual host - one which rewrites all of our domains to 'www.kayoom.com'
  • i've come a little closer, actually IE seems to take the certificate from another subdomain? how does it even get there? – Marian Theisen Sep 21 '11 at 12:03
  • Could you share a real URL? – LazyOne Sep 21 '11 at 12:20
  • Your URL seems to be working fine. Have you found and solved the problem ? – Stephane Sep 21 '11 at 12:42
  • as i said, Internet Explorer mysteriously took the certificate from another subdomain. i deactivated that site, and it works for now, but i need the site on the other subdomain back eventually – Marian Theisen Sep 21 '11 at 12:44

As I understand you have set up both sites to use SSL on the same IP:port?

In general only 1 certificate can be bound to IP:port pair unless server is capable of Server Name Indication (nginx is) and configured to support it (Internet Explorer supports it from v7 I believe).

Try configuring it: http://nginx.org/en/docs/http/configuring_https_servers.html#sni ... or bind subdomain to a different IP:port pair (i.e. same IP but different port (e.g. 45454) or different IP).

  • 1
    thanx, that clears things up. is there any possibility to force nginx to use primarily our production certificate? i don't mind if it serves the production cert occasionally on our staging site, especially if it only happens in internet explorer, but it should never, under no circumstances, use our self signed staging cert for production – Marian Theisen Sep 22 '11 at 8:44
  • i just checked, i have SNI enabled in nginx. – Marian Theisen Sep 22 '11 at 8:46
  • Cannot really say -- I only touched nginx (mostly using IIS 7). But try changing the order how they (sites .. or SSL) are declared -- putting one before another may do the job. – LazyOne Sep 22 '11 at 8:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.