Apache :: Mismatched Address Error

bpladna · Joined: 29 Apr 2015 Posts: 8 Location: USA, Winston-Salem

I created certificate and it appears to be working but I am always getting a cert error about a mismatched address. I have checked my settings and the certificate and host names match. It doesn't make sense. I have looked online at different forums and support sites but nothing has helped. The only thing I can think to do is to get a new cert. This cert is for an internal site only.

Thank you

glsmith

You may have to create another cert. However, where is the error showing, your browser or the error log on the server?

Is this just replacing an expired cert or is this the first?

bpladna · Joined: 29 Apr 2015 Posts: 8 Location: USA, Winston-Salem

The error is only in the browser. There are no errors in any of the logs. This is the first cert.

glsmith

I am assuming you are using self-signed certificates which the browser will error with anyway, even when the addresses match. You will have to create an exception for them in the browser so does it really matter if the addresses match or not?

We would probably need some information, your ssl config (posted at http://apaste.info/) and the URL you are trying to use, what you did with your Windows hosts file if anything to hopefully see what the problem might be.

bpladna · Joined: 29 Apr 2015 Posts: 8 Location: USA, Winston-Salem

Unfortunately I cannot give out the IPs or hostnames because I am not allowed but I have uploaded the three configs (httpd.conf, foswiki.conf, and ssl.conf). Our hosts files cannot be changed due to the fact we do not have admin privs on our computers. I can get it changed if need be.

bpladna · Joined: 29 Apr 2015 Posts: 8 Location: USA, Winston-Salem

Also, we are not using a self signed. It's a CA signed certificate and it's trusted in the browser. This is for an internal web server reached via https://<FQDN>. I also forgot to post the links to the conf files.

http://apaste.info/kzp
http://apaste.info/p3p
http://apaste.info/4xD

bpladna · Joined: 29 Apr 2015 Posts: 8 Location: USA, Winston-Salem

We are still trying to fix this issue.

bpladna · Joined: 29 Apr 2015 Posts: 8 Location: USA, Winston-Salem

It turns out it's what I thought it was the whole time. I had to set the IP to the hostname in my hosts file. Now that works. Now I need to figure out how to configure apache so I can still use the FQDN without having to have that entry in my hosts file. Any thoughts?

glsmith

I'm glad you found that which is why I asked about that file. You can't change anything in Apache, domain names are purely a DNS thing. Using the host file you can fake the DNS. You can do it with a DNS server however, you should probably start by learning what DNS is though.

bpladna · Joined: 29 Apr 2015 Posts: 8 Location: USA, Winston-Salem

I know how DNS works. I think I worded my response incorrectly. This issue has not shown up in other certificates we have created. That's why I don't understand why this one had an issue.

glsmith

I guess you need to ask the CA that issued the certificate then.

bpladna · Joined: 29 Apr 2015 Posts: 8 Location: USA, Winston-Salem

We figured out the issue. Some applications will ignore the CN if it's not one of the SANs. I created a new request and added the FQDN to the SAN list and now it works.