ugh. quick one, hopefully lmao After some server changes last week, our staging server shows NET::ERR_CERT_AUTHORITY_INVALID:
the certificate files on the server look recent, but the browser seems to see something else. could it be serving teh wrong certificate? we use a reverse proxy with auto-HTTPS and have a few sites on teh same machine, how do i see what certificate is really being presented? any commands to check what teh server atcually presents would be great.
see exactly what the server presents: openssl s_client -connect example.com:443 -servername example.com </dev/null | openssl x509 -noout -subject -issuer -dates -ext subjectAltName. That shows teh expiry date and which names teh cert covers. If it dfifers from the files on disk, the web srever isnt using the renewed cert. hope that helps :)
I'd consider switching to the DNS challenge. it doesn't need port 80 open and works for wildcard certs, though it requires API access to ur DNS provider.
Sign in or create an account to reply.
