1

We're serving the web service using nginx.

A client has established a CNAME record pointing from their subdomain:

sub.example1.com to their subdomain on our domain sub.example2.com (secured with a wildcard SSL certificate)

Currently, when you attempt to view: sub.example1.com, the error:
The certificate is not valid (host name mismatch). is displayed and the mismatch error must be ignored to continue.

I have attempted generating a SAN certificate for the subdomain sub.example1.com and serving it separately, but they are really viewing sub.example2.com and this results in the same error.

Is it possible for us to add a SAN to our wildcard certificate to avoid this mismatch error?

Are there any other possible solutions to resolve the mismatch?

Is it possible for us to secure this secondary subdomain on the same certificate or chain them?

Thank you!

EDIT Main nginx.conf, sites-enabled/sub.example1.com and example2.com config example: http://pastebin.com/7AKLag4w

With the above configuration, I am still receiving a mismatch host name certificate error.

A curl -I results in: curl: (60) SSL certificate problem: Invalid certificate chain

The sub.example1.com certificate was created with letsencrypt including the sub.example1.com and sub.example2.com SANs, while the example2.com.crt was created by a standard issuing authority as a wildcard ssl certificate.

  • You need a certificate for the name in the CNAME record. – Tim Oct 8 '16 at 18:07
  • @Tim I have generated a certificate for the client's name in the CNAME record. Where would I serve that in addition to the wildcard certificate we already have? Does this need served separately? – puffy-mallow Oct 8 '16 at 18:17
  • If you use a separate certificate, you must create a separate server block in the nginx configuration for that site. – Michael Hampton Oct 8 '16 at 18:19
  • @MichaelHampton I have attempted to serve the site under it's own server block. Please see my added configuration. This still results in a host name mismatch on the certificate. It appears to still be using the *.example2.com certificate when requesting sub.example1.com which is a CNAME to sub.example2.com. Would I have to modify the cert being served for sub.example2.com as we're catching everything *.example2.com under the wildcard? I am definitely missing something! – puffy-mallow Oct 8 '16 at 19:21
  • I didn't see any Let's Encrypt certificates linked to in the configs you posted. – Michael Hampton Oct 8 '16 at 19:28
1

You need a certificate with the client CNAME, in a separate server block in Nginx.

Alternately generate another certificate that includes your domain name, subdomains, and the CNAME. Lets Encrypt can do this, and it's free.

(Copied comments to an answer so it can be accepted, so people don't all bother to read an answered question).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.