0

My website is: www.ezvid.com

Here is the SSL link: https://www.ezvid.com

Here is an example of an SSL scan service that somehow finds the wrong domain and in turn the wrong certificate -- which means it reports a name mismatch on the cert: https://sslcheck.globalsign.com/en_US/sslcheck?host=www.ezvid.com#198.74.58.202-srv-reg-cert-ssl-misc

Some SSL scans, like the above, report my hostname as *.wpengine.com. I host the site with WordPress Engine, and I understand that is their domain...

I don't understand why their domain is being looked up by many of these online scanners. Could it be a problem with my DNS?

In browsers the SSL cert displays fine, but I need to find a fix for this regardless because various security websites use scans like this to rank the security and trustworthiness of my site. I also have good reason to believe that Google's own security ranking algorithm for domains is looking up the same incorrect hostname. So I need to figure out how to fix this.

I would really really appreciate an expert's insight on this.

Kind regards and thank you in advance for your consideration!

  • What did WP Engine say when you contacted them about this? – Michael Hampton Aug 28 '13 at 23:48
  • Also, whilst the idea is good, the download page is a bit off if you have any plugins installed: i.stack.imgur.com/IMpRu.png – Mark Henderson Aug 29 '13 at 0:00
  • Thank you! WP Engine pointed me to SSL scans that resolve the proper name. I have explained to them the issue isn't that some get it and some don't, but that I need all of these services to get it right. I'm waiting on another response from them. Per the design flaw, we are in the process of redesigning the site--thanks for pointing that out. – danSiebes Aug 29 '13 at 0:25
3

It looks like WPEngine is using SNI - Server Name Indication - for serving multiple SSL websites on a single IP address.

Check it out:

  • https://198.74.58.202/ - loads *.wpengine
  • https://www.ezvid.com/ - loads your site and your certificate

Their SSL checker is out of date. I would submit this to them.

The impact of this? Users on Windows XP using Internet Explorer will be completely unable to access your website over HTTPS. That's the biggest impact to concern yourself with.

Also, you have a bunch of content being served from HTTP rather than HTTPS. This can cause some (older) browsers to have a security fit.

  • Thank you that is very insightful! Do you know if there is a way to use another service alongside SNI to make sure the certificate request always resolves the correct name? – danSiebes Aug 29 '13 at 0:26
  • The only way to do that is the "old" way (SNI is still fairly new in terms of how many people use it), which is to have a dedicated IP address just for your site. Most providers will charge you a fee for this. Some are more reasonable than others. – Mark Henderson Aug 29 '13 at 0:37
  • Got it, thank you again. While we do have a dedicated IP, WPEngine is a highly customized service and due to them hosting WP sites only and how they work their backend I'm afraid I'm not going to be able to work this out. Their system requires the wpengine domain when you create an account, and they have no DNS service. Ie setting up any site on there you start with "site.wpengine.com" I use Route53 to point our domain to their IP. I'll keep checking in with them and post a solution here should any other WPE user ever have this issue. – danSiebes Aug 29 '13 at 0:45
0

Contact GlobalSign. There's something wrong with their scanner. Your site passes here: http://www.sslshopper.com/ssl-checker.html#hostname=www.ezvid.com

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.