I am facing the issue of cross-sharing of SSL certificates between domains hosted on the aaPanel. For example, abc.com using SSL certificate intended for xyz.com xyz.com using 123.com's SSL certificate so on If you renew SSL Certificate for abc.com then it does not work until you renew the SSL certificate for xyz.com & so on.

Hi, No, our domains are not all in one site. Each domain has a different site. Re-applying does not assure fixing the issue, each time. For example. On Saturday one of the sites (say example1.com) was showing an SSL warning. When I checked it was reflecting another domain (say example2.com) from the same aaPanel. I tried to renew the SSL of example1.com. Not worked . Then I tried to renew the SSL of example2.com. However, As soon as renewed the SSL of example2.com, this site too started showing an SSL warning. I tried to re-apply an old SSL certificate from the certificate holder to example2.com. Then SSL warning for example2.com gone. But the example1.com was still showing an SSL warning. Moreover, the aaPanel's inbuilt feature for wildcard SSL also not working for us. We have created a separate non-aaPanel Ubuntu server & create the private key & certificate from it. Then paste it manually in the aaPanel > Domain > SSL certificate.

No. The directories are not the same. We have been facing this issue earlier too (for 1-2 years). However, due to 1 or 2 domains, we renew SSL in a few minutes. - Now, the current aaPanel has a total of 9 domains including sub-domains. So, renewing them is an immensely time-consuming task. FYI: We are using OpenLiteSpeed 1.7.14 + PHP 7.4 + MariaDB 10.4.15 on aaPanel 6.8.24.

szone Hi, aaPanel_Kern solved my SSL issue via email. The solution is simple. I am trying to explain it as follows. Open File Manager Navigate to the path /www/server/panel/vhost/openlitespeed/listen Edit 443.conf Check whether the mapped domain name is mapped to its desired counterpart (domain name) or not Done! ✅ In the above screenshot Line No 2 & 3 are right. ❌ Line No. 4 is problematic, as it is mapped to the wrong domain name. In such a scenario, you might experience the SSL mismatch warning. You just have to remove such lines if a rule already exists. Or map it to the correct domain name. Like map example.com example.com Feel free to reply in case of any concerns. All the best!

SSL certificate mismatch when multiple domain hosted on aaPanel

luckybhumkar

I am facing the issue of cross-sharing of SSL certificates between domains hosted on the aaPanel.

For example,

abc.com using SSL certificate intended for xyz.com
xyz.com using 123.com's SSL certificate
so on

If you renew SSL Certificate for abc.com then it does not work until you renew the SSL certificate for xyz.com & so on.

aaPanel_Kern

luckybhumkar
Hello, are your domains all in one site? Or a different site?
Does trying to re-apply for SSL fix it?

luckybhumkar

Hi,

No, our domains are not all in one site. Each domain has a different site.
Re-applying does not assure fixing the issue, each time.

For example.

On Saturday one of the sites (say example1.com) was showing an SSL warning.
When I checked it was reflecting another domain (say example2.com) from the same aaPanel.
I tried to renew the SSL of example1.com. Not worked.
Then I tried to renew the SSL of example2.com. However, As soon as renewed the SSL of example2.com, this site too started showing an SSL warning.
I tried to re-apply an old SSL certificate from the certificate holder to example2.com. Then SSL warning for example2.com gone.
But the example1.com was still showing an SSL warning.

Moreover, the aaPanel's inbuilt feature for wildcard SSL also not working for us. We have created a separate non-aaPanel Ubuntu server & create the private key & certificate from it. Then paste it manually in the aaPanel > Domain > SSL certificate.

aaPanel_Kern

luckybhumkar
hello, check if the directory is using the same one?

luckybhumkar

No. The directories are not the same.

We have been facing this issue earlier too (for 1-2 years). However, due to 1 or 2 domains, we renew SSL in a few minutes. - Now, the current aaPanel has a total of 9 domains including sub-domains. So, renewing them is an immensely time-consuming task.

FYI: We are using OpenLiteSpeed 1.7.14 + PHP 7.4 + MariaDB 10.4.15 on aaPanel 6.8.24.

aaPanel_Kern

luckybhumkar
Hi, can you give us your aapanel information? If possible please send to kern@aapanel.com.
It is recommended to fill in the following
Post link:
SSH account password and port:
aapanel login link address and account password:

luckybhumkar

szone
Hi, aaPanel_Kern solved my SSL issue via email.

The solution is simple. I am trying to explain it as follows.

Open File Manager
Navigate to the path /www/server/panel/vhost/openlitespeed/listen
Edit 443.conf
Check whether the mapped domain name is mapped to its desired counterpart (domain name) or not
Done!

✅ In the above screenshot Line No 2 & 3 are right.

❌ Line No. 4 is problematic, as it is mapped to the wrong domain name. In such a scenario, you might experience the SSL mismatch warning.

You just have to remove such lines if a rule already exists. Or map it to the correct domain name.
Like map example.com example.com

Feel free to reply in case of any concerns. All the best!

szone

I am also facing similar issues with OpenLiteSpeed. There's a certificate mismatch, even I had manually pasted the SSL CRT, Key and Root Bundles. They work fine on Nginx, but aren't working on OLS.

For instance, I try to apply SSL on Domain A, but it sill shows the SSL of another Domain...

szone

luckybhumkar

Thanks a lot. I had another issue, this 443.conf file had links to other domain's SSL pem files. Which I wanted to change. I was not able to locate this file.

My issue is now fixed. I am able to use my IP Address with Secure SSL now.

After saving the changes to SSL path, inside 443.conf file, I had restarted OLS, and everything worked! <3

ZeroSSL provides free SSL for IPs, however it's only for 3 months so I would have to renew it manually after every 3 months...

viktorek

I also encounter this issue. There are two sites on the host, each with its own certificate; however, the second site displays a certificate error upon opening. When I check, the certificate is for the first site.
openssl s_client -connect 2nd.site.domain:443 | grep -i "subject"
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R11
verify return:1
depth=0 CN = 1st.site.domain
verify return:1
subject=CN = 1st.site.domain

aaPanel_Kern

Hello, please check whether the SSL certificate of the second site is configured? Is the configured certificate the same as the domain name?

viktorek

aaPanel_Kern
Yes, certeficate was received from Let's Encrypt with DNS verification with wildcard domain name and normal domain name
DNS Name=*.2nd.site.domain
DNS Name=2nd.site.domain
Apache 2.4.62
PHP-7.4.33 for 1st site
PHP-8.1.30 for 2nd site
/www/server/panel/vhost/apache/2nd.site.domain.conf

<VirtualHost :80>
ServerAdmin webmaster@example.com
DocumentRoot "/www/wwwroot/2nd.site.domain"
#ServerName 6118d6e5.2nd.site.domain
ServerName 2nd.site.domain
ServerAlias 2nd.site.domain www.2nd.site.domain
#errorDocument 404 /404.html
ErrorLog "/www/wwwlogs/2nd.site.domain-error_log"
CustomLog "/www/wwwlogs/2nd.site.domain-access_log" combined
#HTTP_TO_HTTPS_START
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{SERVER_PORT} !⁴⁴³$
RewriteRule (.) https://%{SERVER_NAME}$1 [L,R=301]
</IfModule>
#HTTP_TO_HTTPS_END
#DENY FILES
<Files ~ (.user.ini|.htaccess|.git|.env|.svn|.project|LICENSE|README.md)$>
Order allow,deny
Deny from all
</Files>
#PHP
<FilesMatch .php$>
SetHandler "proxy:unix:/tmp/php-cgi-81.sock|fcgi://localhost"
</FilesMatch>
#PATH
<Directory "/www/wwwroot/2nd.site.domain">
SetOutputFilter DEFLATE
Options FollowSymLinks
AllowOverride All
Require all granted
DirectoryIndex index.php index.html index.htm default.php default.html default.htm
</Directory>
</VirtualHost>
<VirtualHost *:443>
ServerAdmin webmaster@example.com
DocumentRoot "/www/wwwroot/2nd.site.domain/"
ServerName 2nd.site.domain
ServerAlias 2nd.site.domain www.2nd.site.domain
#errorDocument 404 /404.html
ErrorLog "/www/wwwlogs/2nd.site.domain-error_log"
CustomLog "/www/wwwlogs/2nd.site.domain-access_log" combined
#SSL
SSLEngine On
SSLCertificateFile /www/server/panel/vhost/cert/2nd.site.domain/fullchain.pem
SSLCertificateKeyFile /www/server/panel/vhost/cert/2nd.site.domain/privkey.pem
SSLCipherSuite EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5
SSLProtocol All -SSLv2 -SSLv3
SSLHonorCipherOrder On
#PHP
<FilesMatch .php$>
SetHandler "proxy:unix:/tmp/php-cgi-81.sock|fcgi://localhost"
</FilesMatch>
#DENY FILES
<Files ~ (.user.ini|.htaccess|.git|.svn|.project|LICENSE|README.md)$>
Order allow,deny
Deny from all
</Files>
#PATH
<Directory "/www/wwwroot/2nd.site.domain/">
SetOutputFilter DEFLATE
Options FollowSymLinks
AllowOverride All
Require all granted
DirectoryIndex index.php index.html index.htm default.php default.html default.htm
</Directory>
</VirtualHost>
!<

aaPanel_Kern

Hello, is the problem solved?
If not, please provide the aapanel information.
can you give us your aapanel information? The server makes a snapshot backup first, if possible, please send it to kern@aapanel.com.
It is recommended to fill in the following
Post link:
SSH IP address, account password and port:
aapanel login link address and account password:
Detailed problem description:

No post link will not be able to know which user's information is, and the problem will not be processed

viktorek

aaPanel_Kern Yeah, the problem has been resolved, I forgot that I'm using SSL Deep Inspection for IPS protection between server and client. And both virtual host has been inspected with single certificate from first site. If i want inspect second side traffic to i think i have to use second real ip for separating traffic to host.
Thanks anyway.