<div dir="ltr">I've noticed that its related to the orders of virtual host files. For example if vhost of <a href="http://mydomain.com">mydomain.com</a> comes first than <a href="http://yourdomain.com">yourdomain.com</a> then SSL CN (common name) for both domains will be *.<a href="http://mydomain.com">mydomain.com</a>.<div><br></div><div>And if vhost of <a href="http://yourdomain.com">yourdomain.com</a> comes before than <a href="http://mydomain.com">mydomain.com</a> then common name for both domains is <a href="http://yourdomain.com">yourdomain.com</a> .</div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Aug 4, 2017 at 2:01 AM, shahzaib mushtaq <span dir="ltr"><<a href="mailto:shahzaib.cb@gmail.com" target="_blank">shahzaib.cb@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Update:<br><br>Now i removed vhost for <a href="http://mydomain.com" target="_blank">mydomain.com</a> and <a href="http://yourdomain.com" target="_blank">yourdomain.com</a> is now showing correct Common name. So there's some kind of overlapping in vhosts.<div><br></div></div><div id="m_-2776267015937845177DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2"><br>
<table style="border-top:1px solid #d3d4de">
<tbody><tr>
<td style="width:55px;padding-top:13px"><a href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail&utm_term=icon" target="_blank"><img src="https://ipmcdn.avast.com/images/icons/icon-envelope-tick-round-orange-animated-no-repeat-v1.gif" alt="" width="46" height="29" style="width:46px;height:29px"></a></td>
<td style="width:470px;padding-top:12px;color:#41424e;font-size:13px;font-family:Arial,Helvetica,sans-serif;line-height:18px">Virus-free. <a href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail&utm_term=link" style="color:#4453ea" target="_blank">www.avast.com</a>
</td>
</tr>
</tbody></table><a href="#m_-2776267015937845177_DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2" width="1" height="1"></a></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Aug 3, 2017 at 9:13 PM, shahzaib mushtaq <span dir="ltr"><<a href="mailto:shahzaib.cb@gmail.com" target="_blank">shahzaib.cb@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi,<span><div><br></div><div>>><span style="font-size:12.8px">As far as I know, there are about half a dozen "latest" versions of</span></div><span style="font-size:12.8px">Google Chrome, and none of them are version 64 currently.</span><br style="font-size:12.8px"><div><br></div></span><div>Your're right sorry, the version latest is 60.</div><div><br></div><div><br></div><div>>><span style="font-size:12.8px">You have one client that reports an error message.</span><span style="font-size:12.8px">What are the specific circumstances under which that version of that</span></div><span><span style="font-size:12.8px">client can report that error message? That information may give a hint</span><br style="font-size:12.8px"><span style="font-size:12.8px">as to where the problem is.</span><div><span style="font-size:12.8px"><br></span></div></span><div><span style="font-size:12.8px">Well, i can generate this issue without a problem all i've to do is create a test.html page, put 5 x static video links (our server http2 mp4 video links) and play them simultaneously. For the first request they'll start playing with <b>200</b> status in inspect element under <b>Network </b>tab but for further chunk requests from chrome, it'll stuck in <b>pending </b>and under <b>Console </b>tab spdy error will start to occur. Once i've disabled HTTP2 that issue is gone but 'pending' status issue still was there which i think is linked with my below issue :</span></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">------------------------------<wbr>------------------------------<wbr>----------------<br></span><div><br></div><div>Now we think there's issue with one SSL certificate which we renewed recently. Our server has actually two different domain SSL certificates configured on same ip; <br><br>*.<a href="http://mydomain.com" target="_blank">mydomain.com</a><br>*.<a href="http://yourdomain.com" target="_blank">yourdomain.com</a> (<b>Renewed</b>)<br><br>We've configured both these certificates vhosts in /usr/local/etc/nginx/vhosts/ directory. After installing certificate we tested it with sslshopper and both were installed properly (CN, Intermediate Chain etc were properly listed for each). </div><div><br></div><div>Now here is the twist comes. Recently we've renewed the SSL certificate for <b>*.<a href="http://yourdomain.com" target="_blank">yourdomain.com</a></b> from <b>Godaddy </b>and after that sslshopper shows correct CN and intermediate chain for new certificate (*.<a href="http://yourdomain.com" target="_blank">yourdomain.com</a>) but openssl is showing the CN of *.<a href="http://yourdomain.com" target="_blank">yourdomain.com</a> as of *.<a href="http://mydomain.com" target="_blank">mydomain.com</a>.</div><div><br></div><div>I repeat SSLshopper and SSLLabs shows proper CN (common name) but if i use openssl command to verify it :</div><div><br></div><div>[root@cw012 /usr/ports/security/ca_root_ns<wbr>s]# openssl s_client -connect <a href="http://s4.yourdomain.com:443" target="_blank">s4.yourdomain.com:443</a> |head -30depth=2 C = US, O = GeoTrust Inc., OU = (c) 2008 GeoTrust Inc. - For authorized use only, CN = GeoTrust Primary Certification Authority - G3verify return:1s_clidepth=1 C = US, O = GeoTrust Inc., CN = RapidSSL SHA256 CA - G2verify return:1head depth=0 CN = <b>*.<a href="http://mydomain.com" target="_blank">mydomain.com</a></b><br></div><div><b><br></b></div><div>Here you can see that CN is *.<a href="http://mydomain.com" target="_blank">mydomain.com</a> instead of *.<a href="http://yourdomain.com" target="_blank">yourdomain.com</a>. </div><div><br></div><div>==============================<wbr>================</div><div><br></div><div>Now for testing i had disabled vhost for <a href="http://yourdomain.com" target="_blank">yourdomain.com</a> and used only single <a href="http://mydomain.com" target="_blank">mydomain.com</a> after which requests for serving files improved drastically before that, if we would had hit a page, it'll first go to 'pending' status in chrome inspect element and after few time it'll show 200 status but now it goes directly to 200 status. <br><br>I'm really confused on what's happening right now but if someone has faced this experience before please let me know, on first i thought there could be nginx config issue but the problem is SSLshopper and ssllabs are showing proper CName so now i think maybe its related to chrome</div><div><br></div></div><div><br></div><div>Thanks for your help.<br>Shahzaib</div></div><div id="m_-2776267015937845177m_1565204697939808308DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2"><br>
<table style="border-top:1px solid #d3d4de">
<tbody><tr>
<td style="width:55px;padding-top:13px"><a href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail&utm_term=icon" target="_blank"><img src="https://ipmcdn.avast.com/images/icons/icon-envelope-tick-round-orange-animated-no-repeat-v1.gif" alt="" width="46" height="29" style="width:46px;height:29px"></a></td>
<td style="width:470px;padding-top:12px;color:#41424e;font-size:13px;font-family:Arial,Helvetica,sans-serif;line-height:18px">Virus-free. <a href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail&utm_term=link" style="color:#4453ea" target="_blank">www.avast.com</a>
</td>
</tr>
</tbody></table><a href="#m_-2776267015937845177_m_1565204697939808308_DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2" width="1" height="1"></a></div><div class="m_-2776267015937845177HOEnZb"><div class="m_-2776267015937845177h5"><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Aug 3, 2017 at 12:27 PM, Francis Daly <span dir="ltr"><<a href="mailto:francis@daoine.org" target="_blank">francis@daoine.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span>On Wed, Aug 02, 2017 at 01:17:06PM +0500, shahzaib mushtaq wrote:<br>
<br>
Hi there,<br>
<br>
</span><span>> Thanks for response well i've tried lot more things, updated FreeBsd,<br>
> updated openssl but issue is still there. Do you think is there any<br>
> possibility it is linked with Nginx ?<br>
<br>
</span>You have one client that reports an error message.<br>
<br>
What are the specific circumstances under which that version of that<br>
client can report that error message? That information may give a hint<br>
as to where the problem is.<br>
<br>
Is the problem repeatable? As in: if you do a fresh install with no<br>
historical information of the client browser (a new "profile" or under<br>
a new user account), do you see the same behaviour?<br>
<br>
In a later mail, you suggest that you have two test nginx instances,<br>
and one client reports the error against one instance and not against<br>
the other.<br>
<br>
"nginx -V" on each could be used to identify any differences in the<br>
compile-time settings. "nginx -T" on each could be used to identify any<br>
difference in the run-time configuration.<br>
<span><br>
> <a href="https://pastebin.com/gaVWfWJv" rel="noreferrer" target="_blank">https://pastebin.com/gaVWfWJv</a><br>
><br>
> >>There is more than one version of google chrome. Some web reports suggest<br>
> that SPDY support was going to be removed in version 51.<br>
><br>
> Chrome version is 64 latest which has removed spdy and supports HTTP2 i<br>
> guess.<br>
<br>
</span>As far as I know, there are about half a dozen "latest" versions of<br>
Google Chrome, and none of them are version 64 currently.<br>
<br>
If you ask for help in a Google Chrome mailing list, you may want to<br>
provide the specific version number there to allow them to identify what<br>
exactly you are running.<br>
<div class="m_-2776267015937845177m_1565204697939808308HOEnZb"><div class="m_-2776267015937845177m_1565204697939808308h5"><br>
Good luck with it,<br>
<br>
f<br>
--<br>
Francis Daly <a href="mailto:francis@daoine.org" target="_blank">francis@daoine.org</a><br>
______________________________<wbr>_________________<br>
nginx mailing list<br>
<a href="mailto:nginx@nginx.org" target="_blank">nginx@nginx.org</a><br>
<a href="http://mailman.nginx.org/mailman/listinfo/nginx" rel="noreferrer" target="_blank">http://mailman.nginx.org/mailm<wbr>an/listinfo/nginx</a><br>
</div></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>