This question already has an answer here:

I generated ssl certificate with:

openssl genrsa -out key.pem 2048
openssl req -new -sha256 -key key.pem -out csr.csr
openssl req -x509 -sha256 -days 12775 -key key.pem -in csr.csr -out certificate.pem

but after checking my openssl server with ssllab I got the following invalid message: enter image description here

How to fix this issue?

marked as duplicate by Steffen Ullrich, mdpc, Jenny D, MadHatter, womble Dec 9 '17 at 7:16

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


You need to use the fqnd (in the subject, which fully fits the hostname, in your case the external hostname as the tool you are using is targeting the external hostname) otherwise the certificate would be invalid.

And there is no real way to fix a certificate the correct way would be to revoke the wrong one and create a new one.

Not the answer you're looking for? Browse other questions tagged or ask your own question.