I'm getting the error: requested domain name does not match the server’s certificate when they do match.

[monkey-shines]

Ask a Question!

I have created several self signed certificates for secure web interfaces in my home lab. The certificates are generally working correctly after I import the root ca into the trusted root certificates for windows. I am having trouble with a portainer container accessing via the google chrome and mozilla firefox browser.

I get the error: requested domain name does not match the server’s certificate.

A more complete description of my steps.

1. Generate a root CA key and crt
2. Create a key, csr, and cert for docker.home.arpa (the hostname of my docker virtual machine) signed by the CA
3. Add the CA information to the windows cert store under 'Trusted Root Certification Authorities'
4. Tested self signed certs with other https websites (truenas, adguard, etc.) to ensure no browser errors. No problems so far.
5. Assign an ip address in DNS with authority for home.arpa for the host docker.home.arpa (A record)
6. ensure client can resolve docker.home.arpa
7. Add the hostname option and copy busybox to docker container
8. Run /busybox sh and check hostname via shell to confirm docker.home.arpa is hostname within portainer container
9. Browse the website on https://docker.home.arpa:9443
10. Https is working but there is a certificate error: requested domain name does not match the server’s certificate
11. View the certificate information to confirm it matches the address bar of google and firefox.

My docker run command:

docker run -d -p 9443:9443 -p 8000:8000
--name portainer --restart always
-v /var/run/docker.sock:/var/run/docker.sock
--hostname docker.home.arpa
-v portainer_data:/data
-v /etc/ssl/certs:/certs
portainer/portainer-ce:latest
--tlscert /certs/docker.home.arpa.crt
--tlskey /certs/docker.home.arpa.key

I realize this might not be a portainer issue specifically. Could the port not being 80 cause a mismatch? It does not seem like it. To use a self-signed cert is it required that I spin up a container via macvlan? I am out of ideas and would welcome any input. Thank you in advance for reading.