1

I recently purchased an SSL certificate.

I've got www.site.com.key, www.site.com.csr, intermedia.pem, www.site.com.crt all set up in my /etc/ssl/localcerts folder.

When I open my browser I get the following :

Connection information

The other problem I get is within /var/log/apache2/error.log :

[warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)

[warn] RSA server certificate CommonName (CN) `site.com' does NOT match server name!?

I think the problem is that I've submitted the .csr file with the common name being site.com instead of www.site.com. Therefore the common name, not matching with my server name - www.site.com

Is there any way to get around this problem by manipulating the servername on the server? How can I do this? Or do I have to re-consider getting another SSL certificate with the right credentials?

Thanks in advance.

cwiggo
  • 121
  • 1
  • 6

2 Answers2

2

I would not change the server name, since that would mean that all your search engine results would need updating, and that will take time.

When purchasing server certificates, the standard way is to send the .csr with www. prefix. The certificate provider will then issue a certificate both with and without the prefix.

Tero Kilkanen
  • 36,796
  • 3
  • 41
  • 63
  • It is not always the case that CA's issue for with and without www. Especially for the cheap offers, the opposite is true sometimes. – sebix Jul 17 '15 at 20:32
1

In your certificate request, you must add "Subject Alternate Names" (SAN). Your certificate CN will still be site.com, but the SAN will have the other names your website is reachable with, such as:

  • site.com
  • www.site.com
  • anything-other-as-long-as-it-works.example.com

You'll notice that the I've added the CN in the list of CN and that hosts name need not be in the same domain.

ixe013
  • 1,018
  • 2
  • 10
  • 26
  • The SAN-field in CSRs are often ignored, if you don't pay for multi-domain certificates. Usually CA's only use the public key and CN from the CSR and ignore the rest. – sebix Jul 17 '15 at 20:33