Install a certificate that covers this hostname on Apache

Why it matters

The certificate the server presents is issued for other names, so browsers show a name-mismatch warning and refuse to continue silently. This happens when the host was never added to the certificate, or when the server picks the wrong certificate for the name.

The fix

1. Give the host its own VirtualHost on port 443 with a matching ServerName (and ServerAlias for other names) and its own certificate files.
2. Make sure the certificate lists every name in ServerName and ServerAlias.
3. Test the configuration and reload Apache.

<VirtualHost *:443>
    ServerName example.com
    SSLEngine on
    SSLCertificateFile    /etc/letsencrypt/live/example.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
</VirtualHost>

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the certificate chain and expiry check
• Renew the expired TLS certificate
• Fix a certificate that is not valid yet
• Renew the certificate before it expires
• Replace the self-signed certificate with a trusted one
• Use a certificate from a publicly trusted authority
• Serve the full certificate chain
• Replace the expired intermediate certificate
• Re-issue the certificate with a stronger key
• Replace the certificate that uses a broken hash
• Fix the certificate that browsers reject