# Prevent Chrome SSL Domain Mismatch Warning When Redirecting

**URL:** <https://www.ruby-forum.com/t/prevent-chrome-ssl-domain-mismatch-warning-when-redirecting/229357>\
**Category:** NGINX\
**Created:** [January 2, 2013, 10:17pm UTC](https://www.ruby-forum.com/t/prevent-chrome-ssl-domain-mismatch-warning-when-redirecting/229357 "2013-01-02T22:17:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![isabull](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/f14d63/32.png) [@isabull](https://www.ruby-forum.com/u/isabull)\
**Post date:** [January 2, 2013, 10:17pm UTC](https://www.ruby-forum.com/t/prevent-chrome-ssl-domain-mismatch-warning-when-redirecting/229357/1 "2013-01-02T22:17:25Z")

</div>

Hello,  
I have a SSL cert setup for a domain with no subdomain, i.e.  
[mydomain.org](http://mydomain.org). And a server block setup to redirect all https ‘www’  
subdomain requests to the non subdomain server block. This works fine  
in  
Safari, FF, etc. But Chrome gives me a certificate domain name mismatch  
warning ( The big red warning screen ) How can I prevent this? It’s  
like  
Chrome checks the SSL cert name before even following the nginx  
redirect.  
Here’s what I’m doing. Any help appreciated

server {  
listen 443;  
server\_name [www.mydomain.org](http://www.mydomain.org);

```
  return 301 $scheme://mydomain.org$request_uri;

  ssl on;
  ssl_certificate /etc/nginx/certs/new_sslchain.crt;
  ssl_certificate_key /etc/nginx/certs/azcharters-10-29-12.key;
  ssl_session_timeout 5m;
  ssl_protocols SSLv2 SSLv3 TLSv1;
  ssl_ciphers

```

ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;  
ssl\_prefer\_server\_ciphers on;  
}

server {  
listen 443;  
server\_name [mydomain.org](http://mydomain.org);  
root /home/deploy/apps/myapp/current/public;  
passenger\_enabled on;

```
  ssl on;
  ssl_certificate /etc/nginx/certs/new_sslchain.crt;
  ssl_certificate_key /etc/nginx/certs/azcharters-10-29-12.key;
  ssl_session_timeout 5m;
  ssl_protocols SSLv2 SSLv3 TLSv1;
  ssl_ciphers

```

ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;  
ssl\_prefer\_server\_ciphers on;  
}

–  
Chris I.  
Burst Software  
Rails Web D.

e: removed\_email\_address@domain.invalid  
c: 623-523-2221  
w: [www.burstdev.com](http://www.burstdev.com)  
w: [www.christopherirish.com](http://www.christopherirish.com)  
[http://www.christopherirish.com](http://www.christopherirish.com)

---

<div class="post-metadata">

**Author:** ![isabull](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/f14d63/32.png) [@isabull](https://www.ruby-forum.com/u/isabull)\
**Post date:** [January 2, 2013, 10:34pm UTC](https://www.ruby-forum.com/t/prevent-chrome-ssl-domain-mismatch-warning-when-redirecting/229357/2 "2013-01-02T22:34:23Z")

</div>

On 2 January 2013 21:16, Chris I. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Hello,  
> I have a SSL cert setup for a domain with no subdomain, i.e.  
> [mydomain.org](http://mydomain.org). And a server block setup to redirect all https ‘www’  
> subdomain requests to the non subdomain server block. This works fine in  
> Safari, FF, etc. But Chrome gives me a certificate domain name mismatch  
> warning ( The big red warning screen ) How can I prevent this? It’s like  
> Chrome checks the SSL cert name before even following the nginx redirect.

Of course it does. That’s how SSL works.

You’re serving up the certificate for [azcharters.org](http://azcharters.org) where browsers  
(it’s not just Chrome!) are expecting one that identifies itself as  
belonging to [www.azcharters.org](http://www.azcharters.org). You need to serve up a certificate  
that matches [www.azcharters.org](http://www.azcharters.org) in its Common Name (CN) or Subject  
Alternative Name (SAN), just for the redirect listener block.

If you only have a single IP to serve both :443 listeners, by the way,  
you’re out of luck with your current cert. You’d have to find an SSL  
vendor who’ll sell you a single cert with (say) [azcharters.org](http://azcharters.org) in the  
CN and [www.azcharters.org](http://www.azcharters.org) in the SAN. This may be more expensive than  
you’d expect and - to be honest - I wouldn’t bother.

## Regards, Jonathan

Jonathan M. // Oxford, London, UK

> **[Jonathan Matthews :: Words Typed, Great Rates For Cash](https://www.jpluscplusm.com)**

---

<div class="post-metadata">

**Author:** ![isabull](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/f14d63/32.png) [@isabull](https://www.ruby-forum.com/u/isabull)\
**Post date:** [January 3, 2013, 1:42pm UTC](https://www.ruby-forum.com/t/prevent-chrome-ssl-domain-mismatch-warning-when-redirecting/229357/3 "2013-01-03T13:42:48Z")

</div>

> You’d have to find an SSL vendor who’ll sell you a single cert with (say)  
> [azcharters.org](http://azcharters.org) in the CN and [www.azcharters.org](http://www.azcharters.org) in the SAN. This may be  
> more expensive than you’d expect and - to be honest - I wouldn’t bother.

To avoid such issues quite many SSL vendors include the (www.)  
alternative  
name automatically (like Godaddy, Comodo and Geotrust for sure).

rr

---

<div class="post-metadata">

**Author:** ![isabull](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/f14d63/32.png) [@isabull](https://www.ruby-forum.com/u/isabull)\
**Post date:** [January 3, 2013, 8:04pm UTC](https://www.ruby-forum.com/t/prevent-chrome-ssl-domain-mismatch-warning-when-redirecting/229357/4 "2013-01-03T20:04:49Z")

</div>

Jonathan, Reinis, thank you both for your responses. That clarified  
things  
a lot!

Posted at Nginx Forum:

> **[Re: Prevent Chrome SSL Domain Mismatch Warning When Redirecting](https://forum.nginx.org/read.php?2,234649,234666#msg-234666)**
>
> Hello, I have a SSL cert setup for a domain with no subdomain, i.e. mydomain.org. And a server block setup to redirect all https 'www' subdomain requests to the non subdomain server block. This works fine in Safari, FF, etc. But Chrome gives me a...