Invalid certificate on beta.relisten.live

[lukeswitz]

Quick look at the SSL results shows the site domain mismatched & redirected

108.61.242.184 
- 108.61.242.184.vultr .com  
- Certificate not valid for domain name
- 2001:19f0:5c01:421:5400:ff:fe7a:dd50 
- Unable to connect to the server 

[farktronix]

I'm assuming this is for http://beta.relisten.live? It looks like that redirects to relisten-boarding.dumbledore.alecgorge.com, which is trying to use a cert for newsflashgenie.com. It looks like this is a misconfiguration issue on @alecgorge's server. Alec, can you take a look?

[lukeswitz]

Target: 142.44.136.241

Possible second certificate created by mistake. No nefarious traffic detected or exploited host reports*

Primary Issue: TLS: Certificate mismatch Alternative domains found in cert: me2go-render-server.weasley.alecgorge.com

Common Case Scenarios:

• domain has expired & shares hosting with a newer domain at that address
• CDN which cannot resolve SSL (rare)
• Domain is an alias missing from the certificate

Expanded Detail: me2go-render-server.weasley.alecgorge.com 

Fingerprint SHA256: 26697bfc092c903a1b3f162005a0fe2e01708e8e734dac2a27569c801b44622bPin 

SHA256: EV49Nwd8lXzwOiuv5Y3RymCUV/aTuZ0rkPGidniAOWA=
--
Common names | me2go-render-server.weasley.alecgorge.com

Alternative names | me2go-render-server.weasley.alecgorge.com   
MISMATCH

Serial Number | 03466c715503664917e5097a73f2074c03b8

Valid from | Thu, 24 Sep 2020 23:00:20 UTC

Valid until | Wed, 23 Dec 2020 23:00:20 UTC (expires in 1 month and 22 days)
Key | RSA 4096 bits (e 65537)

Weak key (Debian) | No
Issuer | Let's Encrypt Authority X3  AIA: http://cert.int-x3.letsencrypt.org/
Signature algorithm | SHA256withRSA
Extended Validation | No
Certificate Transparency | Yes (certificate)
OCSP Must Staple | No
Revocation information | OCSP OCSP: http://ocsp.int-x3.letsencrypt.org
Revocation status | Good (not revoked)
Trusted | No   NOT TRUSTED Mozilla  Apple  Android  Java  Windows

I can audit this mismatch, but ideally the owner of the domain should handle the devOps for continuity & security of deployment. Thanks

• Based on analysis using Qualys North American appliances.

[lukeswitz]

Any update on this? Pinging @alecgorge