Record an upgrade HTTPS past the pit

Record a pit that went through the process of upgrading HTTPS

Curl: (Wuyi) ssl:certificate subject name ' mp3.xxx.com ' does not match target host name ' static.xxx.com '

Upgrade http://mp3.xxx.com

Http://static.xxx.com

For

Https://mp3.xxx.com

Https://static.xxx.com

Because the two domain names configured on a single server are resolved to this machine, the static files found on the page cannot be loaded after the configuration is complete.

So F12 looked down and found that the loaded certificate and the browser address bar domain name unexpectedly inconsistent. The static domain name of the request, the correct addition

The certificate of MP3 is downloaded. With Curl also error, not normal return 200, puzzled!

650) this.width=650; "Src=" https://s4.51cto.com/wyfs02/M00/95/73/wKiom1kVUdShTRn_AAEWh3KimtM195.png-wh_500x0-wm_ 3-wmp_4-s_3822386825.png "title=" Certificate consumer and Address bar domain name inconsistent "alt=" wkiom1kvudshtrn_aaewh3kimtm195.png-wh_50 "/>

[Email protected] ~]# curl-i https://static.xxx.com/static/lib/less.min.js

Curl: (Wuyi) ssl:certificate subject name ' mp3.xxx.com ' does not match target host name ' static.xxx.com '

650) this.width=650; "Src=" https://s2.51cto.com/wyfs02/M02/95/73/wKiom1kVVTiBXarsAAAXOto0L40811.png-wh_500x0-wm_ 3-wmp_4-s_4011905730.png "title=" qq picture 20170512142201.png "alt=" Wkiom1kvvtibxarsaaaxoto0l40811.png-wh_50 "/>

Later to the great Google, found that the original is Nginx TLS SNI support function is not open, SNI (server name indicates) does not open, an IP only supports one SSL certificate, does not support multiple certificates, and the server is Yum installed Nginx, the default TLS SNI Support is off, after recompiling Nginx and specifying the OpenSSL library, TLS SNI support is turned on and access is normal.

Another problem is that in this case, with Curl test, the status code can not return 200, the LS SNI support also still error, can not return to the normal 200. Look at Curl official feedback, this seems to be a curl version 7.15.5 bug, with a new curl than 7.15.5 7.19. Version 7 test is normal.

This article is from the "Czwanga" blog, make sure to keep this source http://czwanga.blog.51cto.com/4840967/1925013

Record an upgrade HTTPS past the pit