Hi,
I am trying to setup a wildcard SSL for my domain. I generated it using certbot and got the congratulations message via:
/usr/local/bin/certbot-auto certonly --manual --preferred-challenges=dns --email=peter@mydomain.com --server https://acme-v02.api.letsencrypt.org/directory --agree-tos -d mydomain.com
Going to https://www.mydomain.com works fine, the problem is when I go to https://mydomain.com in Firefox I get:
Web sites prove their identity via certificates. Firefox does not trust this site because it uses a certificate that is not valid for mydomain.com. The certificate is only valid for www.mydomain.com.
Here is my Apache config:
<IfModule mod_ssl.c>
<VirtualHost *:443>
ServerAdmin peter@mydomain.com
ServerName mydomain.com
ServerAlias www.mydomain.com audio.mydomain.com mydomain.com
DocumentRoot /home/mydomain/repos/mydomain.com/public
<Directory /home/mydomain/repos/mydomain.com/public>
Allowoverride All
Options FollowSymLinks
Require all granted
</Directory>
CustomLog ${APACHE_LOG_DIR}/access.log combined
ErrorLog ${APACHE_LOG_DIR}/error.log
SSLCertificateFile /etc/letsencrypt/live/mydomain.com-0001/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/mydomain.com-0001/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
</IfModule>
This is the output of apachectl -S
VirtualHost configuration:
*:443 is a NameVirtualHost
default server mydomain.com (/etc/apache2/sites-enabled/001-mydomain.com-le-ssl.conf:2)
port 443 namevhost mydomain.com (/etc/apache2/sites-enabled/001-mydomain.com-le-ssl.conf:2)
alias www.mydomain.com
alias mydomain.com
port 443 namevhost mydomain.com (/etc/apache2/sites-enabled/002-bookstack-le-ssl.conf:2)
alias wiki.mydomain.com
port 443 namevhost git.mydomain.com (/etc/apache2/sites-enabled/003-gog-le-ssl.conf:2)
alias git
*:80 is a NameVirtualHost
default server mydomain.com (/etc/apache2/sites-enabled/001-mydomain.com.conf:1)
port 80 namevhost mydomain.com (/etc/apache2/sites-enabled/001-mydomain.com.conf:1)
alias www.mydomain.com
alias audio.mydomain.com
port 80 namevhost mydomain.com (/etc/apache2/sites-enabled/002-bookstack.conf:1)
alias wiki.mydomain.com
port 80 namevhost git.mydomain.com (/etc/apache2/sites-enabled/003-gog.conf:1)
alias git
ServerRoot: "/etc/apache2"
Main DocumentRoot: "/var/www/html"
Main ErrorLog: "/var/log/apache2/error.log"
Mutex ssl-stapling: using_defaults
Mutex proxy: using_defaults
Mutex ssl-cache: using_defaults
Mutex default: dir="/var/lock/apache2" mechanism=fcntl
Mutex mpm-accept: using_defaults
Mutex watchdog-callback: using_defaults
Mutex rewrite-map: using_defaults
PidFile: "/var/run/apache2/apache2.pid"
Define: DUMP_VHOSTS
Define: DUMP_RUN_CFG
User: name="www-data" id=33
Group: name="www-data" id=33
And the output of /usr/local/bin/certbot-auto certificates
Requesting to rerun /usr/local/bin/certbot-auto with root privileges...
/opt/eff.org/certbot/venv/local/lib/python2.7/site-packages/cryptography/hazmat/bindings/openssl/binding.py:163: CryptographyDeprecationWarning: OpenSSL version 1.0.1 is no longer supported by the OpenSSL project, please upgrade. The next version of cryptography will drop support for it.
utils.CryptographyDeprecationWarning
Saving debug log to /var/log/letsencrypt/letsencrypt.log
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Found the following certs:
Certificate Name: audio.mydomain.com-0001
Domains: audio.mydomain.com
Expiry Date: 2020-03-29 10:11:53+00:00 (VALID: 89 days)
Certificate Path: /etc/letsencrypt/live/audio.mydomain.com-0001/fullchain.pem
Private Key Path: /etc/letsencrypt/live/audio.mydomain.com-0001/privkey.pem
Certificate Name: audio.mydomain.com
Domains: audio.mydomain.com wiki.mydomain.com www.mydomain.com
Expiry Date: 2019-05-23 11:46:42+00:00 (INVALID: EXPIRED)
Certificate Path: /etc/letsencrypt/live/audio.mydomain.com/fullchain.pem
Private Key Path: /etc/letsencrypt/live/audio.mydomain.com/privkey.pem
Certificate Name: mydomain.com-0001
Domains: *.mydomain.com
Expiry Date: 2020-03-29 10:42:02+00:00 (VALID: 89 days)
Certificate Path: /etc/letsencrypt/live/mydomain.com-0001/fullchain.pem
Private Key Path: /etc/letsencrypt/live/mydomain.com-0001/privkey.pem
Certificate Name: mydomain.com
Domains: mydomain.com
Expiry Date: 2020-03-29 10:50:21+00:00 (VALID: 89 days)
Certificate Path: /etc/letsencrypt/live/mydomain.com/fullchain.pem
Private Key Path: /etc/letsencrypt/live/mydomain.com/privkey.pem
Certificate Name: www.mydomain.com
Domains: www.mydomain.com
Expiry Date: 2020-03-29 10:12:30+00:00 (VALID: 89 days)
Certificate Path: /etc/letsencrypt/live/www.mydomain.com/fullchain.pem
Private Key Path: /etc/letsencrypt/live/www.mydomain.com/privkey.pem
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Can anyone help?
Regards, Peter
This textbox defaults to using Markdown to format your answer.
You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!
These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.
Join our DigitalOcean community of over a million developers for free! Get help and share knowledge in Q&A, subscribe to topics of interest, and get courses and tools that will help you grow as a developer and scale your project or business.
Hello, @PeterHere
Looking at the current virtual host, mydomain.com is using the following SSL files:
Which are the files for the wildcard:
I will recommend you to use a certificate decoder for the certifcate file and check if the SSL covers the mydomain.com version. It should says that it’s not covered, because you’re already experiencing the issue.
https://www.sslshopper.com/certificate-decoder.html
I’ve also noticed that you have a separate SSL for mydomain.com:
And what you can do is to the SSLCertificateKeyFile and SSLCertificateFile for mydomain.com in the virtual host to use these files:
instead of the current SSL files for the wildcard - mydomain.com-0001 and this should solve the issue for you. You can also try and issue another wildcard and make sure to include the main domain as well.
Hope this helps.
Regards, Alex