0

At one time our company hosted our own blog which we hosted with our wildcard cert for the domain, *.example.com. We moved our company blog to Hubspot and the team at Hubspot setup a second SSL cert for www.example.com for the Hubspot hosted blog (I have no idea why this all happened before I started here).

We are now having an intermittent issue with our apex domain https://example.com. Sometimes it resolves fine but sometimes in Chrome you get the scary "Your connection is not private" warning. Hubspot's response was to have us create a redirect with EasyRedirect, which I have done, but that hasn't resolved it.

If I curl -vL example.com it works fine but curl -vL https://example.com gives me SSL: no alternative certificate subject name matches target host name 'example.com'

Is there something I can do about these competing SSL certs for our apex domain?

|improve this question
  • 1
    Are you using example.com for your AD domain? If yes, then you are probably getting the wrong IP occasionally, and hitting a DC. In the domain used for AD, the apex of the zone is owned by the domain. – Zoredache Jan 23 at 18:27
  • Btw, start simple. Do an nslookup example.com is it reporting multiple IPs? – Zoredache Jan 23 at 18:40
  • Can you provide a little bit more about your webserver configuration (nginx, apache, etc.)? you can easily redirect all requests going towards example.com to example.com. Please let me know what webserver you are using and I will provide you. e.g. in nginx: server { listen 80 default_server; listen [::]:80 default_server; server_name example.com www.example.com; return 301 https://www.example.com$request_uri; } – Dmitriy Kupch Jan 23 at 20:14
  • @DmitriyKupch Hubspot hosts one site I don't have any details. The other is on Heroku. – Mike Breen Jan 24 at 19:18
  • @Zoredache Yes the Non-authoritative answer is reporting 2 IPs – Mike Breen Jan 24 at 19:23
2

A site binding can only have 1 SSL certificate assigned to it. It sounds like Hubspot has the www.example.com certificate bound to your site and that certificate does not have a SAN for example.com. You should do a couple things here:

  1. Reissue your SSL certificate and include a SAN for example.com
  2. Redirect anyone going to example.com to www.example.com (This will not resolve the "Your connection is not private" message until you do #1. This is because the SSL connection occurs before the site is displayed and you will not be able to redirect people until they trust your certificate.

If they were using your wildcard certificate then none of this would matter and both URLs would result in a valid certificate. Depending on how long you've been at the company it's possible your wildcard certificate is expired and you'd need a new one anyway. There is probably a way to work with Hubspot to have a CSR generated and go buy your own wildcard certificate if your company wants to go that route.

|improve this answer
  • Thanks. The wildcard cert has not expired because it was renewed in December. I tried to work with Hubspot's team to explain this but they have not been very helpful. They have made this very clear that it's "my problem". I'll give this a try and report back. – Mike Breen Jan 24 at 19:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.