Https://main.domain is secure (valid cert), but https://www.main.domain is not?

Website, Application, Performance Security
1

I hava free Cloudflare account with 3 domains setup. The web files are hosted at NameCheap, but I have the DNS records on Cloudflare. They all seem to be mostly working, but one of the domains works (i.e. the SSL cert is valid) for the main domain, whereas the www subdomain gives an invalid certificate ( Error 526) for www.mydomain.com.

Do I just need to adjust something in the DNS records on Cloudflare for that ?

2

It sounds like your host doesn’t have the cert set up for the www subdomain. Double check what certs you have installed there.

3

That was correct. The certificate was issued for the FQDN and not the www subdomain. My options I guess are to re-issue it through NameCheap or change the setting on Cloudflare for SSL/TLS from Strict to Flexible. I think I’ll try the latter first.

The certificate does not include the www version of the domain due to the automatic HTTP-based validation completed only for sias.dev on the Sectigo side. We are sorry for this inconvenience.

If you wish to include both sias.dev and www.sias.dev, you may reissue it manually and use the DNS-based (Add CNAME) or Email-based validation instead.
For the detailed reissue guide, please follow this link: https://www.namecheap.com/support/knowledgebase/article.aspx/811/70/how-do-i-reissue-my-ssl-certificate

Alternatively, since you are using Cloudflare SSL, you may switch the SSL mode on the Cloudflare side to Flexible. This way the error will be avoided.

4

That’s terrible advice and I’m disappointed that they’d recommend an insecure setup.

1 Like
5

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.