I've got a Nginx server with SSL certificate signed by a my own CA (EIT-CA-G2) at https://ds-client.demo.e-it.nz
For some reason both my Chrome 61 and SSL Labs tester complain about name mismatch. Chrome says:
NET::ERR_CERT_COMMON_NAME_INVALID Subject: ds-client.demo.e-it.nz Issuer: EIT CA G2 Root Expires on: 16 Oct 2022 Current date: 12 Oct 2017
while SSL Labs says:
SSL Report: ds-client.demo.e-it.nz (220.127.116.11) Certificate name mismatch Try these other domain names (extracted from the certificates): ds-client.demo.e-it.nz
Interestingly they don't complain about untrusted certificate but instead about name mismatch. I've got the CA Root imported in Chrome cert store, so it should be trusted anyway.
I can't spot any difference - the URL says ds-client.e-it.co.nz and the certificate says the same. What's wrong??
For the record Mozilla Firefox 56 opens the site without complains (also with the Root cert in its store).
Here are the site and the CA certs:
What's wrong with the certificate?