Home / user-426093

eeijlar's questions

Martin Hope
eeijlar
Asked: 2017-09-12 12:08:43 +0800 CST
  • 1

I am trying to secure a domain with haproxy. When I load the URL: bitbucket.kl.company.com, I get the error:

bitbucket.kl.company.com uses an invalid security certificate.

This certificate is only valid for the following names:
*.company.com, company.com, bitbucket-mirror.company.com

Error Code: SSL_ERROR_BAD_CERT_DOMAIN

Now if I go onto the server and do the following:

 openssl x509 -text -noout -in /etc/haproxy/certs/cert.pem | grep DNS
                DNS:*.company.com, DNS:company.com, DNS:bitbucket.kl.company.com

I contacted Digicert who issue the certificates, and they said the server was issuing the wrong certificate.

In my haproxy.cfg I have:

frontend bitbucket_http_frontend
    bind *:80
    bind *:443 ssl crt /etc/haproxy/certs/cert.pem ciphers HIGH:!aNULL:!MD5
    redirect scheme https code 301 if !{ ssl_fc }
    default_backend bitbucket_http_backend

This appears to be what is happening...

haproxy is issuing other certificates from within /etc/haproxy/certs

I didn't expect or ask it to do that, but that is the only conclusion that makes sense, unless there is a default location that it looks in first.

ssl
Martin Hope
eeijlar
Asked: 2017-08-30 21:41:03 +0800 CST
  • 4

I am trying to secure a sub domain:

bitbucket.kl.company.com

The certificate is for *.company.com. So I get an error:

bitbucket.kl.company.com uses an invalid security certificate. The certificate is only valid for the following names: *.company.com, company.com, bitbucket-mirror.company.com Error code: SSL_ERROR_BAD_CERT_DOMAIN

The puzzling thing is that some browsers don't complain, and load the page as expected. Is my certificate wrong? Can I order a certificate specifically for bitbucket.kl.company.com, and not use *.company.com?

ssl