1

I've got a Nginx server with SSL certificate signed by a my own CA (EIT-CA-G2) at https://ds-client.demo.e-it.nz

For some reason both my Chrome 61 and SSL Labs tester complain about name mismatch. Chrome says:

NET::ERR_CERT_COMMON_NAME_INVALID
Subject: ds-client.demo.e-it.nz
Issuer: EIT CA G2 Root
Expires on: 16 Oct 2022
Current date: 12 Oct 2017

while SSL Labs says:

 SSL Report: ds-client.demo.e-it.nz (52.62.59.234)
 Certificate name mismatch 
 Try these other domain names (extracted from the certificates):
 ds-client.demo.e-it.nz

Interestingly they don't complain about untrusted certificate but instead about name mismatch. I've got the CA Root imported in Chrome cert store, so it should be trusted anyway.

I can't spot any difference - the URL says ds-client.e-it.co.nz and the certificate says the same. What's wrong??

For the record Mozilla Firefox 56 opens the site without complains (also with the Root cert in its store).

Here are the site and the CA certs:

What's wrong with the certificate?

Improve this question

2 Answers 2

Reset to default
4

Your certificate is missing X509v3 Subject Alternative Name extension. Paradigm shifted at some point and CN is not used to verify host name anymore.

You can google for materials how to modify openssl configuration so it adds this extension to certificates.

Improve this answer
1
  • 1
    That's it. With subjectAltName set it works as expected, thanks!
    – MLu
    Oct 12, 2017 at 22:26
0

I see in your certificate this:

 CN=ds-client.demo.e-it.nz/emailAddress=hostmaster@enterpriseit.co.nz

and as far as I know it must be

 CN=ds-client.demo.e-it.nz

For me this is the reason of your problem

Improve this answer
1
  • I have recreated the cert without emailAddress (and updated the files at the links) but it's still the same behaviour :(
    – MLu
    Oct 12, 2017 at 10:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .