10

I am provisioning my server on DigitalOcean, and although I am getting an A+ rating from ssllabs,

https://www.ssllabs.com/ssltest/analyze.html?d=zandu.biz

when I connect to my site, https://www.zandu.biz or https://zandu.biz, I get a unsecure notice inside Chrome.

How do I solve this?

48

This server could not prove that it is www.zandu.biz; its security certificate is from zandu.biz. This may be caused by a misconfiguration or an attacker intercepting your connection.

The name in your site's certificate is zandu.biz, which is not valid for a different name (www.zandu.biz). Moreover, you have a redirect from zandu.biz to www.zandu.biz, so if you use the name the certificate is valid for it redirects to the name that it isn't.

What you need is to get a certificate with both names.

  • 4
    Wildcard certificates can be more convenient or necessary if the names you intend to use aren't actually known ahead of time. But they also increase your exposure if the associated private key is compromised because then the attacker can forge any name in your domain rather than only the ones that server was actually using. – zrm Aug 14 at 22:37
  • 4
    Let's Encrypt is a CA. When they first started out they were cross-signed by IdenTrust but that ends in 2020 because their own root certificate is now widely trusted. None of that has anything to do with your problem, which would have been the same either way. – zrm Aug 15 at 0:35
  • 8
    s/Common Name/Subject Alternative Name/ -- Chrome hasn't used Common Name at all for 2 years; other browsers do so only if SAN is absent, which hasn't been true for any (EE) certs from public CAs since before 2010, although you can arrange it for test certs you create yourself. Which is exactly why you can get one cert for multiple domains -- ancient certs using only Common Name couldn't do that. – dave_thompson_085 Aug 15 at 5:40
  • 12
    @djdomi a wildcard certificate for *.example.com still doesn't cover the bare domain example.com. You still need two values in the SAN. – Michael - sqlbot Aug 15 at 13:18
  • 4
    The bigger reason to avoid a wildcard certificate is that OP is using LetsEncrypt. While LetsEncrypt does support wildcard certificates, this requires a DNS challenge. Satisfying a DNS challenge is harder to automate. Also, automating a DNS challenge may mean that a compromised server will grant attackers access to your DNS. So, it's sufficient to use either a UCC certificate or two certificates (which approach doesn't matter much. Do whichever is easier). – Brian Aug 15 at 14:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.