webzod
account

Install a certificate that covers this hostname on nginx

tls.cert.wrong_host · effort: minutes

Why it matters

The certificate the server presents is issued for other names, so browsers show a name-mismatch warning and refuse to continue silently. This happens when the host was never added to the certificate, or when the server picks the wrong certificate for the name.

The fix

  1. Give the host its own server block on 443 with its own certificate files. A request for a name that matches no server_name gets the default server's certificate, which is the usual cause of this finding.
  2. If you use certbot, name the certificate to change with --cert-name and list every name it should cover, then reload nginx. The folder /etc/letsencrypt/live/<name> is named after the first -d value of the original request, so run sudo certbot certificates to see the real name and path.
  3. Test the configuration and reload.
/etc/nginx/conf.d/site.conf 
server {
    listen 443 ssl;
    server_name example.com;

    # use the path that "sudo certbot certificates" shows
    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
}

# add a missing name to an existing certbot certificate (list ALL names it should cover)
# sudo certbot --nginx --cert-name <name> -d example.com -d other-name.example
# sudo nginx -t && sudo systemctl reload nginx

The examples use example.com. Replace it with your own domain.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.