Solve SSL Labs test alerts

This guide explains how to correctly interpret the detailed information provided by Qualys SSL Labs (https://www.ssllabs.com/ssltest/) which may sometimes seem technical or alarming without an appropriate context.

Preamble

• Qualys SSL Labs is an analysis tool widely used to evaluate the SSL/TLS configuration of websites.
• Warnings in their reports are often only technical details without impacting the safety or SEO of the site.

Multiple certificates in SSL Labs reports

When SSL Labs analyzes a site, it can display several numbered certificates (certificate #1, certificate #2, etc.). This happens for several reasons:

1. Principal certificate (#1)The certificate submitted when the NIF (Server Name Indication) is used.
   • The SNI is a TLS extension that allows a server to host multiple SSL certificates for different domains on the same IP address. When a browser connects, it indicates the domain name it wishes to join.
2. Secondary certificate (#2)The certificate submitted when the NIS is not used or when connecting directly via IP.

An indication "No SNI" in certificate #2 is not a mistake It simply means that SSL Labs has tested what happens when a client connects without providing SNI information. In this case:

• The server serves a backup certificate (often a generic or preview certificate).
• This situation concerns only very obsolete customers who do not support the NIS.
• Modern browsers all use the NIS and will therefore receive certificate #1.

Certificate chain problems

"Chain issues: Incorrect order, Extra certs, Contains anchor"

These warnings do not necessarily mean that the certificate is defective:

• Incorrect order: Intermediate certificates are not presented in the optimal order.
• Extra certs: Additional certificates not required are included.
• Contains anchor: The root certificate is included in the chain.

The TLS protocol allows to omit the root certificate as it is normally already present in the certificate stores of the browsers. Including it is not an error, but a redundancy.

“Alternative names mismatch”

For the emergency certificate (#2), the warning "MISMATCH" is normal because:

• This certificate is designed for another field (preview.infomaniak.website).
• It is presented only when the NIS is not used.
• The browser receiving this certificate would identify it as not corresponding to the requested domain, but this does not affect normal connections with SNI.

On SEO concerns:

• Google and other search engines use modern browsers that support the NIS.
• They receive the #1 certificate that is valid for your domain.
• Warnings concerning certificate #2 have no impact on the SEO.
• Only problems with the main certificate (#1) could affect the SEO.

This configuration is perfectly suited for shared hosting where several sites share the same infrastructure, with a preview certificate serving as a folding solution.