Site used to be hosted at example.com. Nameservers were set to example.com's nameservers (ns1.example.com, ns2.example.com).

Site was then moved to example1.com, but nameserver settings were kept. But the example.com account expired, so the records on ns1.example.com, ns2.example.com which pointed to example1.com were removed.

Yikes. Site not found.

Updated the registrar record for the site to have nameservers to point to ns1.example1.com, and ns2.example1.com. Propagation is starting to work but some users are getting an expired certificate error.

Will this go away in two days when propagation is complete? If not, how can I fix it (or even, is it possible to fix it sooner)?

1 Answer 1


Both issues are (should be) completely orthogonal, as long as both sets of nameservers server the same zone content, that is provide the same IP addresses for your website.

After that, you obfuscated your question so much (and so badly, please read RFC2606 to see how to obfuscate properly) that it is very hard to answer you with relevant data.

It remains that:

  • nameservers and DNS is used in your case to map the hostname to an IP address; TLS and x.509 certificates have nothing to do here
  • after having received an IP address a browser will then connect to it and starts the TLS Handshake, if using HTTPS. During the handshake, the server will reply with a certificate. It is up to the server to give back a server that will "please" the clients.

So in short: do all nameservers reply with the same IP address for your website? What is the "good" and the "bad" certificates returned?

If the IP returned is not the same, then indeed when every cache will learn about the new nameserers all visitors should arrive to the new website with the correct certificate. If your old hoster has closed your account maybe your old website was replaced by a default one, with a generic certificate, that will not match anymore the website name, hence errors in browsers.

This would also train you to think about this next time: you should either separate web and DNS hosting (so that if you change one piece it does not impact the others) but that means 2 providers, or making sure to transfer things in such a way that it will not break (typically configuring everything on the new nameservers, then changing the at the registry, then only moving the website).

  • I suspect that returning the wrong IP address due to incomplete propagation is the real root cause. For example, when I test on globalsign.ssllabs.com, it shows the wrong address and gives a "Certificate Name Mismatch" error. Commented May 24, 2018 at 0:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.