0

I had four websites configured on an Ubuntu 22.04 server using NginX.

There was a technical problem with the database connection that required me to move the four websites to a new server.

I moved three of them to one server, and the fourth to a different server. This is the problem domain.

I created new Letsencrypt certificates for all four sites.

The fourth site, now on a separate server from the other three, is showing an error This website is not secure when I visit it.

When I look at the certificate details, the certificate is for one of the other three websites, on a different server, with a different domain name.

I did two things:

  • logged in to the old server and did certbot delete for all the certificates
  • logged in to the new server which is NOT hosting the problem site and did certbot delete for the incorrect certificate that was being shown in the browser error page

Now, the deleted certificate for the wrong domain name is still being shown in the browser (Safari & Chrome/Mac).

From what I understand, SSL certificates are not cached, but are supplied by the server with each request.

  1. in Terminal on the Mac, I tried curl -vvI https://example.com, and got the correct, new certificate.
  2. in Terminal I tried echo | openssl s_client -showcerts -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -inform pem -noout -text and got the certificate from the other server
  3. I re-did the first command and this time I got the wrong certificate

A friend roughly 15,000km away also gets the wrong certificate.

I don't understand how it is possible:

  • the certificate being shown was on a separate server from the beginning
  • it was for a different domain name from the beginning
  • it has been deleted
  • the new, correct certificate was available from the beginning (and I tried re-installing it)
6
  • Is the DNS record pointing to the correct IP address? Nov 16 at 13:22
  • Yes, it was the first thing I checked. It was updated when the site was moved. What's strange is that the wrong certificate being supplied is from one of the other three new sites AFTER they were moved, not from the old dead server.
    – Andy Swift
    Nov 16 at 13:31
  • AAAA NOO IT WAS THE WRONG IP ADDRESS
    – Andy Swift
    Nov 16 at 13:33
  • It was just habit — the server for this site has had the same name for seven years; the new server has the same name, so I updated to the new IP address forgetting that this one site was now on a different server with a different name & IP. I owe you a beer if you're ever in Toulouse.
    – Andy Swift
    Nov 16 at 13:36
  • Now there's a second mystery that I will just ignore: why did the website work at all if the DNS was pointing to the wrong server?
    – Andy Swift
    Nov 16 at 13:42

0

You must log in to answer this question.

Browse other questions tagged .