1

We created a bunch of subdomains on our shared hosting account for testing and noted that:

a) For the first few minutes of the subdomains life, the SSL certificate being served was for a completely different domain, not even one owned by us or added to our hosting account

b) For some subdomains, the SSL certificate being served was and still is for a different subdomain (another one of ours)

Upon asking tech support, they said "that is how SANS certificate works". This seems somewhat suspicious and now I'm worried about continuing with this host, because an SSL issue later could come back to bite me. What are everyone's thoughts on this? Anyone experience similar issues?

Update: Confirmed that the first issue (cert issued to xyz.com being served for sub.mydomain.com for a brief period after creation) also occurs on another host. This other host does not use Let's Encrypt, and instead uses cPanel self-signed certificates. I'm starting to think this is a cPanel bug (whatever handles assigning certificates to subdomains automatically). One server has apache and the other litespeed. The cPanel versions in both hosts are 62.0.20 and 64.0.15.

Improve this question
6
  • That is not normal, or good. Something is set wrong. Most likely in the virtual host definition for the subdomains. To get actual help with the problem will require more information about the setup and configuration. You hosting provider may, or may not, be at fault - depends on who maintains what for the configuration, and who installs the certs. If it's a Linux server with the cPanel interface and you loaded the certs manually, then it could have been as simple as pasting the wrong cert (unreadable by humans anyway) into the boxes on the web form. If so, just try to reload the certs.
    – user73967
    Apr 25, 2017 at 1:56
  • @GypsySpellweaver I would assume that there is some automated process generating the Let's Encrypt certificates and assigning them to subdomains as they are created, and the fact that I'm getting a cert on my subdomain for a domain outside of my account implies there's a bug with that automated system.. maybe the cert takes a few minutes to generate? And in the meantime it can't find it so it uses the next one on it's list?
    – user77376
    Apr 25, 2017 at 2:21
  • The server should only offer the cert it was told to offer for the domain. It is possible, near zero probability, that there's a bug in the server that would look for a different cert. If the certs are handled without your involvement, then it is a bug in the backend somewhere, which you cannot solve. I'd recommend an ultimatum to the host - "fix it or I leave" and set a, short, time limit. There is zero excuse for a host to mishandle SSL certs! There are plenty of operational clients for LE automation, that any host can find one that works without making their own buggy version.
    – user73967
    Apr 25, 2017 at 2:29
  • @GypsySpellweaver I updated the question with new findings. I hope others who use shared hosting with cPanel can test on their hosts so I can confirm my "bug with cPanel" theory.
    – user77376
    Apr 25, 2017 at 3:23
  • Just tested it on mine with cPanel 64.0.17 on a LiteSpeed server (shared hosting), brand new sub brand new cert. Took a couple (maybe 5) seconds to go from original self-signed to valid LE cert. I really doubt that it's a problem with the cPanel plug-in (not a native part of cPanel BTW). You can try starting at community.letsencrypt.org with the possibility of a bug if you like though. My bet, however, is that the host didn't get something set right on their end. cPanel and the LE plug-in are too wide-spread for an issue to go unfound for very long.
    – user73967
    Apr 25, 2017 at 3:43

1 Answer 1

Reset to default
1

It is not surprising to me that it takes a few minutes to set up an SSL certificate correctly and that some other certificate is served until it is properly set up.

When there is no SSL virtual host configuration for a domain, Apache falls back to the default site. That would explain why there is some other certificate initially while your subdomain is being set up. It isn't anything to worry about. New subdomains shouldn't get traffic right away. Just make sure it is properly set up by the time users see it.

It is possible that "that is how SAN certificate works" means that your host is getting a single certificate that covers multiple subdomains. If that is the case, that is also fine. The certificate will list one subdomain as the "main" subdomain, but it will work for all the listed subdomains. Having multiple subdomains covered in a single certificate is absolutely fine. Here is an example from digicert:

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.