Weird SSL common name mismatch












0















Today I came across a weird case of cn mismatch. I have two domains:



kpmg.talentsource.rs and
www.kpmg.talentsource.rs



both have prod.q.ssl.global.fastly.net as their CNAME
they have the same A records and certificates.



Nevertheless:



https://kpmg.talentsource.rs (OK)



https://www.kpmg.talentsource.rs (CN mismatch)




https://www.ssllabs.com/ssltest/analyze.html?d=kpmg.talentsource.rs&s=151.101.65.62
https://www.ssllabs.com/ssltest/analyze.html?d=www.kpmg.talentsource.rs&s=151.101.65.62



Note: none of the two has the kpmg.talentsource.rs in neither the the CN nor the SAN



Any ideas why this is happening?






ssl ssl-certificate







share|improve this question

























  • @TheNewOne I don't own the servers. I am just curious. Regardless of that, I am interested to know why the certificate fails, not why the server returns 500 when connected, which shouldn't require access to the server. e.g. how chrome identifies that the certificate of the first domain is good and the second's is bad?

    – user10679118
    Nov 20 '18 at 12:50













  • Removed the comments because they were misleading. The answer seems right :)

    – TheNewOne
    Nov 20 '18 at 15:47
















0















Today I came across a weird case of cn mismatch. I have two domains:



kpmg.talentsource.rs and
www.kpmg.talentsource.rs



both have prod.q.ssl.global.fastly.net as their CNAME
they have the same A records and certificates.



Nevertheless:



https://kpmg.talentsource.rs (OK)



https://www.kpmg.talentsource.rs (CN mismatch)




https://www.ssllabs.com/ssltest/analyze.html?d=kpmg.talentsource.rs&s=151.101.65.62
https://www.ssllabs.com/ssltest/analyze.html?d=www.kpmg.talentsource.rs&s=151.101.65.62



Note: none of the two has the kpmg.talentsource.rs in neither the the CN nor the SAN



Any ideas why this is happening?






ssl ssl-certificate







share|improve this question

























  • @TheNewOne I don't own the servers. I am just curious. Regardless of that, I am interested to know why the certificate fails, not why the server returns 500 when connected, which shouldn't require access to the server. e.g. how chrome identifies that the certificate of the first domain is good and the second's is bad?

    – user10679118
    Nov 20 '18 at 12:50













  • Removed the comments because they were misleading. The answer seems right :)

    – TheNewOne
    Nov 20 '18 at 15:47














0












0








0








Today I came across a weird case of cn mismatch. I have two domains:



kpmg.talentsource.rs and
www.kpmg.talentsource.rs



both have prod.q.ssl.global.fastly.net as their CNAME
they have the same A records and certificates.



Nevertheless:



https://kpmg.talentsource.rs (OK)



https://www.kpmg.talentsource.rs (CN mismatch)




https://www.ssllabs.com/ssltest/analyze.html?d=kpmg.talentsource.rs&s=151.101.65.62
https://www.ssllabs.com/ssltest/analyze.html?d=www.kpmg.talentsource.rs&s=151.101.65.62



Note: none of the two has the kpmg.talentsource.rs in neither the the CN nor the SAN



Any ideas why this is happening?






ssl ssl-certificate







share|improve this question
















Today I came across a weird case of cn mismatch. I have two domains:



kpmg.talentsource.rs and
www.kpmg.talentsource.rs



both have prod.q.ssl.global.fastly.net as their CNAME
they have the same A records and certificates.



Nevertheless:



https://kpmg.talentsource.rs (OK)



https://www.kpmg.talentsource.rs (CN mismatch)




https://www.ssllabs.com/ssltest/analyze.html?d=kpmg.talentsource.rs&s=151.101.65.62
https://www.ssllabs.com/ssltest/analyze.html?d=www.kpmg.talentsource.rs&s=151.101.65.62



Note: none of the two has the kpmg.talentsource.rs in neither the the CN nor the SAN



Any ideas why this is happening?






ssl ssl-certificate




ssl ssl-certificate






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited Nov 20 '18 at 9:47







user10679118

















asked Nov 20 '18 at 9:26









user10679118user10679118

62




62













  • @TheNewOne I don't own the servers. I am just curious. Regardless of that, I am interested to know why the certificate fails, not why the server returns 500 when connected, which shouldn't require access to the server. e.g. how chrome identifies that the certificate of the first domain is good and the second's is bad?

    – user10679118
    Nov 20 '18 at 12:50













  • Removed the comments because they were misleading. The answer seems right :)

    – TheNewOne
    Nov 20 '18 at 15:47



















  • @TheNewOne I don't own the servers. I am just curious. Regardless of that, I am interested to know why the certificate fails, not why the server returns 500 when connected, which shouldn't require access to the server. e.g. how chrome identifies that the certificate of the first domain is good and the second's is bad?

    – user10679118
    Nov 20 '18 at 12:50













  • Removed the comments because they were misleading. The answer seems right :)

    – TheNewOne
    Nov 20 '18 at 15:47

















@TheNewOne I don't own the servers. I am just curious. Regardless of that, I am interested to know why the certificate fails, not why the server returns 500 when connected, which shouldn't require access to the server. e.g. how chrome identifies that the certificate of the first domain is good and the second's is bad?

– user10679118
Nov 20 '18 at 12:50







@TheNewOne I don't own the servers. I am just curious. Regardless of that, I am interested to know why the certificate fails, not why the server returns 500 when connected, which shouldn't require access to the server. e.g. how chrome identifies that the certificate of the first domain is good and the second's is bad?

– user10679118
Nov 20 '18 at 12:50















Removed the comments because they were misleading. The answer seems right :)

– TheNewOne
Nov 20 '18 at 15:47





Removed the comments because they were misleading. The answer seems right :)

– TheNewOne
Nov 20 '18 at 15:47












1 Answer
1






active

oldest

votes


















1














The certificate has a Subject Alternative Name of *.talentsource.rs (among many others unrelated one).



Per X.509/TLS rules, a * matches only one level/label, it does not cross the dot so to say. So *.talentsource.rs matches an hostname of kpmg.talentsource.rs but NOT www.kpmg.talentsource.rs, hence the browser error.



You need either to add www.kpmg.talentsource.rs or *.kpmg.talentsource.rs as a SAN (note that it has talentsource.rs already in the list too) in this certificate or stop using www.kpmg.talentsource.rs at all (a redirection will not solve the problem as you still need the TLS handshake to complete first before getting the HTTP Location: header, so you still need appropriate certificate).






share|improve this answer























    Your Answer






    StackExchange.ifUsing("editor", function () {
    StackExchange.using("externalEditor", function () {
    StackExchange.using("snippets", function () {
    StackExchange.snippets.init();
    });
    });
    }, "code-snippets");

    StackExchange.ready(function() {
    var channelOptions = {
    tags: "".split(" "),
    id: "1"
    };
    initTagRenderer("".split(" "), "".split(" "), channelOptions);

    StackExchange.using("externalEditor", function() {
    // Have to fire editor after snippets, if snippets enabled
    if (StackExchange.settings.snippets.snippetsEnabled) {
    StackExchange.using("snippets", function() {
    createEditor();
    });
    }
    else {
    createEditor();
    }
    });

    function createEditor() {
    StackExchange.prepareEditor({
    heartbeatType: 'answer',
    autoActivateHeartbeat: false,
    convertImagesToLinks: true,
    noModals: true,
    showLowRepImageUploadWarning: true,
    reputationToPostImages: 10,
    bindNavPrevention: true,
    postfix: "",
    imageUploader: {
    brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
    contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
    allowUrls: true
    },
    onDemand: true,
    discardSelector: ".discard-answer"
    ,immediatelyShowMarkdownHelp:true
    });


    }
    });














    draft saved

    draft discarded


















    StackExchange.ready(
    function () {
    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53389858%2fweird-ssl-common-name-mismatch%23new-answer', 'question_page');
    }
    );

    Post as a guest















    Required, but never shown

























    1 Answer
    1






    active

    oldest

    votes








    1 Answer
    1






    active

    oldest

    votes









    active

    oldest

    votes






    active

    oldest

    votes









    1














    The certificate has a Subject Alternative Name of *.talentsource.rs (among many others unrelated one).



    Per X.509/TLS rules, a * matches only one level/label, it does not cross the dot so to say. So *.talentsource.rs matches an hostname of kpmg.talentsource.rs but NOT www.kpmg.talentsource.rs, hence the browser error.



    You need either to add www.kpmg.talentsource.rs or *.kpmg.talentsource.rs as a SAN (note that it has talentsource.rs already in the list too) in this certificate or stop using www.kpmg.talentsource.rs at all (a redirection will not solve the problem as you still need the TLS handshake to complete first before getting the HTTP Location: header, so you still need appropriate certificate).






    share|improve this answer




























      1














      The certificate has a Subject Alternative Name of *.talentsource.rs (among many others unrelated one).



      Per X.509/TLS rules, a * matches only one level/label, it does not cross the dot so to say. So *.talentsource.rs matches an hostname of kpmg.talentsource.rs but NOT www.kpmg.talentsource.rs, hence the browser error.



      You need either to add www.kpmg.talentsource.rs or *.kpmg.talentsource.rs as a SAN (note that it has talentsource.rs already in the list too) in this certificate or stop using www.kpmg.talentsource.rs at all (a redirection will not solve the problem as you still need the TLS handshake to complete first before getting the HTTP Location: header, so you still need appropriate certificate).






      share|improve this answer


























        1












        1








        1







        The certificate has a Subject Alternative Name of *.talentsource.rs (among many others unrelated one).



        Per X.509/TLS rules, a * matches only one level/label, it does not cross the dot so to say. So *.talentsource.rs matches an hostname of kpmg.talentsource.rs but NOT www.kpmg.talentsource.rs, hence the browser error.



        You need either to add www.kpmg.talentsource.rs or *.kpmg.talentsource.rs as a SAN (note that it has talentsource.rs already in the list too) in this certificate or stop using www.kpmg.talentsource.rs at all (a redirection will not solve the problem as you still need the TLS handshake to complete first before getting the HTTP Location: header, so you still need appropriate certificate).






        share|improve this answer













        The certificate has a Subject Alternative Name of *.talentsource.rs (among many others unrelated one).



        Per X.509/TLS rules, a * matches only one level/label, it does not cross the dot so to say. So *.talentsource.rs matches an hostname of kpmg.talentsource.rs but NOT www.kpmg.talentsource.rs, hence the browser error.



        You need either to add www.kpmg.talentsource.rs or *.kpmg.talentsource.rs as a SAN (note that it has talentsource.rs already in the list too) in this certificate or stop using www.kpmg.talentsource.rs at all (a redirection will not solve the problem as you still need the TLS handshake to complete first before getting the HTTP Location: header, so you still need appropriate certificate).







        share|improve this answer












        share|improve this answer



        share|improve this answer










        answered Nov 20 '18 at 15:11









        Patrick MevzekPatrick Mevzek

        3,70591529




        3,70591529
































            draft saved

            draft discarded




















































            Thanks for contributing an answer to Stack Overflow!


            • Please be sure to answer the question. Provide details and share your research!

            But avoid …



            • Asking for help, clarification, or responding to other answers.

            • Making statements based on opinion; back them up with references or personal experience.


            To learn more, see our tips on writing great answers.




            draft saved


            draft discarded














            StackExchange.ready(
            function () {
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53389858%2fweird-ssl-common-name-mismatch%23new-answer', 'question_page');
            }
            );

            Post as a guest















            Required, but never shown





















































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown

































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown







            -

            Popular posts from this blog

            Guess what letter conforming each word

            Image
            6 $begingroup$ This is an entry in the Fortnightly Topic Challenge #41: Short and Sweet. 1 letter only could be mean anything . With an additional letter in front , could be used as medicine component and something you definitely learn or at least heard once. Add another letter in front , you would possibly hear that many times . Add an additional letter in front , you would found an independent country . With an additional letter, in the end , you would found something related to apple . Add another letter in the end , you would found something bad . Hint: Each letter is unique . word knowledge letters chemistry share | improve this question ...
            Read more

            Port of Spain

            Image
            For ports in the country of Spain, see List of ports in Spain. City in City of Port of Spain, Trinidad and Tobago Port of Spain City City of Port of Spain Top to bottom (left to right): Skyline of Port of Spain from Gulf of Paria; National Academy for the Performing Arts, Independence Square, Eric Williams Plaza; MovieTowne, Port of Port of Spain Motto(s):  "We Gather Strength As We Go Along" Port of Spain Coordinates: 10°40′N 61°31′W  /  10.667°N 61.517°W  / 10.667; -61.517 Coordinates: 10°40′N 61°31′W  /  10.667°N 61.517°W  / 10.667; -61.517 Country   Trinidad and Tobago Jurisdiction City of Port of Spain Settled 1560 Incorporated (town) 1853 Incorporated (city) 1914 Government  • Mayor Joel Martinez  • Governing body City Corporation Area [1]  • City 12 km 2 (5 sq mi) Elevation [2] 66 m (217 ft) Population (2011) [1]  • City 37,074  • Rank 3rd  • Density 3,090/km 2 (8,000/sq mi)...
            Read more

            Run scheduled task as local user group (not BUILTIN)

            Image
            0 I am trying to run a scheduled task with User Group (not a single user). This is working fine when I in the field "when running a task, use the following user account:" insert BUILTIN User Group (for example: Administrators or Users). But when I try it with the created Local User Group (example: TestGroup) it is not working. The Users in the TestGroup are the same as in the Administrators group. What could be the problem? Are there some restrictions to the Created User Group compared to BUILTINUsers? scheduled-tasks taskscheduler windowstaskschedule share | improve this question asked Nov 15 '18 at 15:36 Far...
            Read more