Resolved Wrong Let's Encrypt Certificate for alias subdomain

[Roberto84.c]

Hi all. I am having an annoying problem in assigning the Let's Encrypt SSL certificate for an alias domain. I have several subdomains and with web hosting it works perfectly (and alias too). This is the scenario:

mydomain.tld / www.mydomain.tld / another.mydomain.tld (they work, every certificate belongs to their respective subdomains, no wrong certificate alerts in web browser)
When I create the alias name "cdn.mydomain.tld", the assigned certificate to this one belongs to "another.mydomain.tld" .... I can't understand why and obviously I get a browser alert. I tried to test an alias by creating "cdn2.mydomain.tld" and the certificate is assigned correctly..... what's wrong ?

Plesk Obsidian v18.0.38_build1800211001.19
CentOS Linux 7.9.2009 (Core)

Thank you.

 

[Roberto84.c]

Hi all. I am having an annoying problem in assigning the Let's Encrypt SSL certificate for an alias domain. I have several subdomains and with web hosting it works perfectly (and alias too). This is the scenario:

mydomain.tld / www.mydomain.tld / another.mydomain.tld (they work, every certificate belongs to their respective subdomains, no wrong certificate alerts in web browser)
When I create the alias name "cdn.mydomain.tld", the assigned certificate to this one belongs to "another.mydomain.tld" .... I can't understand why and obviously I get a browser alert. I tried to test an alias by creating "cdn2.mydomain.tld" and the certificate is assigned correctly..... what's wrong ?

Plesk Obsidian v18.0.38_build1800211001.19
CentOS Linux 7.9.2009 (Core)

Thank you.

Sorry, I posted in the wrong section

 

[Nik G]

hello @Roberto84.c ,
could you please provide what version of Let's Encrypt extension is installed in your system ?

could you please explain, did you reissued certificate manually after you created cdn.mydomain.tld to cover alias ?

were there some errors in panel.log within this period?

p.s> I've moved your post to the correct forum.

 

[Roberto84.c]

Hello Nik.

could you please provide what version of Let's Encrypt extension is installed in your system ?

- Let's Encypt version: 2.13.6-736

could you please explain, did you reissued certificate manually after you created cdn.mydomain.tld to cover alias ?

- Well it start to give me browser alert, first days in October. I tried to renew the alias certificate manually for cdn.mydomain.com and for the main domain too (for covering the alias).

were there some errors in panel.log within this period?

I cannot check due an error when trying to login with SSH terminal with Plesk GUI: "Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password)

p.s> I've moved your post to the correct forum.

Thank you

 

[Roberto84.c]

I can't understand the logic why only the alias "CDN" is not assigned to the main wildcard domain cert. Which file is responsible for assigning the alias certificate ?
Thanks.

 

[Bitpalast]

I cannot check due an error when trying to login with SSH terminal with Plesk GUI: "Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password)

Likely in /etc/ssh/sshd_config the PermitRootLogin parameter is set to "no", prohibiting login with the "root" user. In this case you can still login with SSH, but only with an SSH client and a user account on the system. Onced logged in you can escalate your privileges with the "su" command and gain full console access.

 

[Nik G]

@Roberto84.c
domain alias configured in domain config at
/var/ww/vhosts/system/mydomain.tld/conf/httpd.conf

there should be something like like below in this file:

 <VirtualHost 10.52.76.216:443 >
        ServerName "mydomain.tld"
        ServerAlias "www.mydomain.tld"
        ServerAlias "ipv4.mydomain.tld"
        ServerAlias "cdn.mydomain.tld"
        ServerAlias "www.cdn.mydomain.tld"
        ServerAlias "ipv4.cdn.mydomain.tld"
        UseCanonicalName Off


<-- skipped -->

        SSLEngine on
        SSLVerifyClient none
        SSLCertificateFile /usr/local/psa/var/certificates/scfllyrOx
        SSLCACertificateFile /usr/local/psa/var/certificates/scfU6B3xs

so, after renewal certificate should contain appropriate info that it is valid for cdn.mydomain.tld
and config for domain should contain alias records for new alias.

 

[Roberto84.c]

@Peter Debik
thank you, I solved logging through SSH with appropriate user account.

domain alias configured in domain config at
/var/ww/vhosts/system/mydomain.tld/conf/httpd.conf

there should be something like like below in this file:

<VirtualHost 10.52.76.216:443 >
ServerName "mydomain.tld"
ServerAlias "www.mydomain.tld"
ServerAlias "ipv4.mydomain.tld"
ServerAlias "cdn.mydomain.tld"
ServerAlias "www.cdn.mydomain.tld"
ServerAlias "ipv4.cdn.mydomain.tld"
UseCanonicalName Off


<-- skipped -->

SSLEngine on
SSLVerifyClient none
SSLCertificateFile /usr/local/psa/var/certificates/scfllyrOx
SSLCACertificateFile /usr/local/psa/var/certificates/scfU6B3xs


so, after renewal certificate should contain appropriate info that it is valid for cdn.mydomain.tld
and config for domain should contain alias records for new alias.

Thank you. I found it in /var/www/vhosts/system/mydomain.tld/conf/nginx.conf

server {
listen 10.52.76.216:443 ssl http2;

server_name www.mydomain.tld;
server_name ipv4.mydomain.tld;
server_name cdn.mydomain.com;
server_name www.cdn.mydomain.com;

ssl_certificate /usr/local/psa/var/certificates/scfe3bsf9;
ssl_certificate_key /usr/local/psa/var/certificates/scfe3bsf9;

client_max_body_size 128m;

root "/var/www/vhosts/mydomain.tld/httpdocs";
access_log "/var/www/vhosts/system/mydomain.tld/logs/proxy_access_ssl_log";
error_log "/var/www/vhosts/system/mydomain.tld/logs/proxy_error_log";

add_header X-Cache-Status $upstream_cache_status;
set $no_cache "";
<-- skipped -->

in /var/www/vhosts/system/mydomain.tld/conf/httpd.conf

<IfModule mod_ssl.c>

<VirtualHost 5.249.157.125:7081 >
ServerName "mydomain.tld"
ServerAlias "www.mydomain.tld"
ServerAlias "ipv4.mydomain.tld"
ServerAlias "cdn.mydomain.tld"
ServerAlias "www.cdn.mydomain.tld"
ServerAlias "ipv4.cdn.mydomain.tld"
UseCanonicalName Off


<-- skipped -->

SSLEngine on
SSLVerifyClient none
SSLCertificateFile /usr/local/psa/var/certificates/scfe3bsf9
SSLCACertificateFile /usr/local/psa/var/certificates/scfUddJE3

</IfModule>

Thanks.

 

[Roberto84.c]

Are them how it should expect?

 

[Nik G]

Are them how it should expect?

for the first look they are correct..