Site loads on and off, "invalid certificate"

Community Support
1

Hello, I got a fresh install, all good except randomly the site loads fine and then invalid certificate. I tried clearing cache restarting browsers both Firefox and Chrome show same error, the certificate works intermittently.
I’m using Let’s Encrypt.

So basically i’m working on the site through https, all loads perfectly, i go to the bathroom and then boom, no certificate.
Clear browsers cache, restart them it loads again, works normally for 30 minutes and then boom! broken again.
And this happened several time all day.
I have installed like 40 servers using certbot and never had this anything like this. So i don’t understand how’s this even possible. Any idea is appreciated.

asd
asd1209×2154 255 KB

2

Hi @PaulKellerman,

Without the actual domain name it will be hard to help.

Before the issue and during the issue, check what is the certificate served by your web server (replace example.net by the actual domain):

openssl s_client -connect example.net:443 -servername example.net <<<: 2>/dev/null | openssl x509 -noout -issuer -subject -dates -ext subjectAltName| sed -E -e 's/^\s*//' -e '/^X509v.*/d' -e 's/^DNS:/SANs: /' -e 's/\s?DNS://g'

When the issue occurs, what is the name of the certificate that appears?

3 
unable to load certificate
140620176823616:error:0909006C:PEM routines:get_name:no start line:../crypto/pem/pem_lib.c:745:Expecting: TRUSTED CERTIFICATE

cert_broke
cert_broke619×1530 121 KB

4

I’m sorry but without context I’ve no idea what you mean.

If you got that message after executing the command I gave to you, seems you have a problem.

Regarding the screenshots, useed.fr is showing a certificate with a wildcard on the common name but your current certificate is issued to useed.fr and www.useed.fr, no wildcard so I suppose you are accessing any other subdomain… (deploy, monitoring, wiki, docker-hub, etc.)

Sorry but with only this info, I can’t help.

5

I figured it out.
There was an outdated DNS on the registrar.
So the same domain pointed to 2 IP’s. One was no longer mine.
It was round robin like it’s 1995.

1 Like
6

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.