SSL Certificates - The common name is causing problems

The knowledge base is lacking some serious information, and I wish Winhost would take the time to update the page rather than give examples without possible solutions.

Here's the issue: recently, my SSL cert expired (intentionally) because I purchased the wildcard version last year only to find out it does NOT cover "domain.com" websites.

So, today I purchased the "domain.com" $29 cert and registered my site (peppermintvault.com) without the "www" prefix.

Now the cert doesn't work at all, giving me a message stating that it only covers "peppermintvault.com".

The problem is the domain constantly returns to www.peppermintvault.com and I have absolutely idea how to stop it from doing it.

I've altered my web.config file to remove the redirect to "peppermintvault.com" from the HTTP request, so there are no longer any redirects.

Can someone here explain to me how in the world we're supposed to covert BOTH the "www." and the non "www." part using a single certificate, because IT'S BAFFLING!

There is no way to add two certs to one site from the CP, so any help will be greatly appreciated.

In the meantime, I'm going to have no choice but to spend yet another $29 to generate a "www." cert and remove the existing cert.

UPDATE:
Seems the cert is working for the non www version of the site. I guess it took a bit of time to register the cert?

Also saw I can add additional certs, so now I have two.

All's well, but sheesh what a headache.

 

SSL certificates are not exactly simple or intuitive to use, and recent events just add a new layer of confusion. Glad you got yours sorted out though.

If you have a suggestion for the Knowledge Base we'd be glad to hear it. For a subject like SSL certificates there's a lot of information to provide and it isn't easy to make it digestible.

 

Suggestions I have:

-A wildcart cert will NOT cover "domain.com". It will also not cover mail.domain.com or ftp.domain.com, since they reside on separate servers.

-A minimum of two SSL certs will be required to cover single domain registrations. One cert will cover "domain.com" and the other will cover "www.domain.com". Sub-domains will also require individual SSL cert purchases if a wildcard cert is not used.

That'll help, I think.

 

Arrrrrrrrrrgh! See, this is so confusing to me! When I spoke to the folks at Rapid, they told me I would need two certs, so I bought another one. Here's my current listing for certs for my domain, peppermintvault.com:

www.peppermintvault.com
RapidSSL
Issued 05/01/2016

peppermintvault.com
RapidSSL Issued
05/01/2016

So, does this mean only 1 cert is now active? The step-by-step guide showed me how to add both certs.

The service rep at Rapid told me the server had nothing to do with the cert, but the domain name and pointer did. If both are pointing to the same location, both had to have separate certs. He said the reason is the "." before "peppermintvault", which counts as a qualifier (my word, as I can't remember what he called it). Wildcard certs look for the domain name, then the qualifier, and resolves accordingly. Last year, the wildcard cert I bought did NOT cover "peppermintvault.com", to which I was recommended to put a redirect on IIS.

Since there is no "." before the name "peppermintvault", then there was nothing to resolve. The example was anything before "peppermint" couldn't be treated as the wildcard, for example, "icecreampeppermintvault" couldn't be covered by the wildcard cert. Without the ".", it might as well be icecreampeppermintvault. That's why he said the other cert would cover the name without the ".".

When I get some time, I'll remove the redirect script that was added last year to cover what the wildcard cert didn't and see if "peppermintvault.com" shows the lock in the address bar. If it doesn't, I guess I wasted money again. >:[

 

I have no idea. I simply followed the instruction on Winhost. There are only two cert options to buy.

This was due to the misunderstanding of the common name, which I put down as "peppermintvault.com". I had no clue it meant to include the "www." as well. That cert did NOT cover "www.peppermintvault.com", so I purchased the other one and put the common name as "www.peppermintvault.com".

I'm pretty sure I purchased two $29 certs, as linked from Winhost. Huh. Having just looked at the cert listings, when did the other non-Rapid SSL options get added?

 

Except that it doesn't cover it, which is why I bought the other one.

After I bought the cert, I removed the redirect script from IIS. www. worked perfectly, but when I typed in "peppermintvault.com", without the www., I got the "This certificate is not valid for this site" (or something like that - though I'm pretty sure it said the common name could not be resolved or trusted with the existing cert).

I waited, and tried again a few hours later, just to ensure there was no delay in setting it up, and the same message appeared.

The information you provided certainly explains why the other cert didn't work.

Bottom line was to throw the redirect script back into place and just allow the "www.peppermintvault.com" cert take over from there.

That's why the guy at Rapid told me the non-www. site won't be covered because "peppermintvault.com" is not a (or rather, the) common name.

Isn't the common name supposed to be the domain?

Years ago, on another web hosting site that's now long dead, I remember their customer service person telling me that having the "www." in front of the name would be beneficial since most people add it, and if I stuck with the non-www name, I should order the other with it and point it to the same server (to keep anyone else from taking it).

I don't believe this has changed, and looking at my domain list and seeing both names on it, this tells me it hasn't.

What's the common name of "www.peppermintvault.com" AND "peppermintvault.com"?

 

Here I was thinking it was because I had two certs why it all worked. Given only one cert works on this site, I reconfigured my config file to redirect only http traffic, and sure enough, it's working.

One final question: I'd like to remove the useless "peppermintvault.com" cert from the SSL Certificates page. I don't see an option to do this, so is there a way I can do it or should I just ignore it?

 

I will ignore it then.

Thanks for all your help!