Cover both the www and the bare domain in the certificate

Why it matters

The www and bare versions of the domain answer on HTTPS, but one of them is served with a certificate that is not issued for it. Visitors who type or follow that version see a security warning.

The fix

1. Re-issue the certificate with both names, for example the bare domain and www.
2. Install it for both and reload the web server.
3. If you do not want to serve one of the names, remove its DNS record or redirect it, but note that the redirect itself needs a valid certificate on that name too.
4. Confirm each name with the command below.

# list ALL names the certificate should cover; sudo certbot certificates shows its <name>
sudo certbot --nginx --cert-name <name> -d example.com -d www.example.com    # or --apache
for h in example.com www.example.com; do
  echo "$h"; openssl s_client -connect "$h":443 -servername "$h" </dev/null 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName
done

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the certificate names and validity window check
• Use a certificate with a standard validity period