Share

Question

Hi People.

We got certificate from Geotrust and try to install in server ubuntu - apache2 - openssl but show to us everytime same error:
AH01909: RSA certificate configured for www.xxx.com:443 does NOT include an ID which matches the server name

The conf apache file is correct same instructions:

<VirtualHost xxx.com:443>
  ServerAdmin webmaster@xxx.com
  DocumentRoot "/var/www/xxx/htdocs"
  ServerName xxx.com
  DirectoryIndex index.html index.php
  ErrorLog /var/www/xxx/log/ssl_error.log
  TransferLog /var/www/xxx/log/ssl_access.log
  SSLEngine On
  SSLProtocol all

  ServerPath "/var/www/lenharomegastore/htdocs"


  SSLCertificateFile /var/www/xxx/ssl2/xxx.crt
  SSLCertificateKeyFile /var/www/xxx/ssl2/xxx.key
  SSLCertificateChainFile /var/www/xxx/ssl2/positive_bundle.crt
  SSLCACertificateFile /var/www/lenharomegastore/ssl2/positive_bundle.crt

  <Directory "/var/www/XXX/htdocs">
     AllowOverride All
     Options Indexes Includes FollowSymLinks
     Order allow,deny
     Allow from all
  </Directory>
</VirtualHost>

We already verified if certificate is perfect with command

openssl x509 -in lenharomegastore.crt -noout -subject

and show to us

subject= /OU=Domain Control Validated/OU=PositiveSSL/CN=xxx.com

Thanks a lot friends

Answer 1

stabidlo September 6, 2014

add the following to virtualhost configuration

ServerAlias www.xxx.com
RewriteEngine On
RewriteCond %{HTTP_HOST} ^www(.)$
RewriteRule ^(.)$ https://xxx.com [R=301,L]

Reply

Answer 2

TonyTsang September 5, 2014

If the common name is xxx.com, then you can only use that cert on xxx.com but not www.xxx.com.

You may contact Geotrust to see if they can revoke the current cert and reissue a new cert with CN www.xxx.com. Otherwise you may have to buy another cert only for www.xxx.com.

Most cert authorities will include the root domain as an alias, so you don't have to buy cert specifically for the root domain.

Reply

Answer 3

capone September 7, 2014

Hi Tony and Stabidlo.

Thanks a lot for the informations.

Tony:
The Certificate is correct only with xxx.com not www.xxx.com

stabidlo
We try to adjust apache adding this configuration but same error show in apache´s log:

[Sun Sep 07 00:24:13.977344 2014] [ssl:warn] [pid 22537] AH01909: RSA certificate configured for www.xxx.com:443 does NOT include an ID which matches the server name

I already tried to adjust a lot of ways but not work, the certificate is perfect, and I already verifiy all configuration in the apache, this is a crazy.

Thanks friends

Reply

stabidlo September 7, 2014

Just out of curiosity, try this in /etc/apache2/ (or whatever the root config dir in ubuntu is)

grep -r -i www.xxx.com *

It would be nice to see if this domain name is configured anywhere in apache configuration
It's just annoying warning, should not have an impact on functionality, anyway it would be good to understand where it is coming from :-)

capone September 8, 2014

Hi Friends.

With command :

grep -r -i www.xxx.com *

The Results:

sites-available/www.xxx.com.conf:        ServerAlias www.xxx.com xxx
sites-available/www.xxx.com.conf:#  ServerAlias www.xxx.com

Thanks

stabidlo September 8, 2014

What happens when you change the ServerName to www.xxx.com?

Answer 4

stabidlo September 7, 2014

Just out of curiosity, try this in /etc/apache2/ (or whatever the root config dir in ubuntu is)

grep -r -i www.xxx.com *

It would be nice to see if this domain name is configured anywhere in apache configuration
It's just annoying warning, should not have an impact on functionality, anyway it would be good to understand where it is coming from :-)

capone September 8, 2014

Hi Friends.

With command :

grep -r -i www.xxx.com *

The Results:

sites-available/www.xxx.com.conf:        ServerAlias www.xxx.com xxx
sites-available/www.xxx.com.conf:#  ServerAlias www.xxx.com

Thanks

stabidlo September 8, 2014

What happens when you change the ServerName to www.xxx.com?

Answer 5

jasonp September 29, 2014

openssl x509 -in lenharomegastore.crt -noout -subject
subject= /OU=Domain Control Validated/OU=PositiveSSL/CN=xxx.com

Check given command, it seems that the SSL is issued by comodo.

As your said in your question,you purchased SSL certificate from GeoTrust. Please check you have configured new GeoTrust SSL certificate.

“does NOT include an ID which matches the server name”

at first impression, the reason behind this error is due to your domain name in SSL certificate does not match your real domain name. You should make sure that the common name and SAN domain names, both should match your primary domain name.

If you can not resolve the issue with given tips, you can contact our chat support @ ssl2buy.com. Ask for this discussion reference; so that they can provide you free support. SSL certificate is purchased from us or elsewhere, does not matter. We’ll provide you free cost installation and technical support.

Reply