Help with SSL Issue on Subdomains – ERR_SSL_VERSION_OR_CIPHER_MISMATCH
Original message was deleted
SSupport AI
Based on the provided documentation, the issue you're experiencing is likely due to the fact that Cloudflare's Universal SSL certificates only cover the apex domain and one level of subdomain.
According to the documentation, "By default, Cloudflare Universal SSL certificates only cover your apex domain and one level of subdomain." (Source: https://developers.cloudflare.com/ssl/troubleshooting/version-cipher-mismatch/)
In your case, the subdomain
The warning "This hostname is not covered by a certificate. Learn more." is also expected behavior, as Cloudflare is indicating that the subdomain is not covered by a certificate.
To resolve this issue, you can consider ordering an Advanced Certificate or uploading a Custom Certificate that covers the subdomain. (Source: https://developers.cloudflare.com/ssl/edge-certificates/additional-options/total-tls/error-messages/)
I hope this helps clarify the issue and provides a possible solution.
According to the documentation, "By default, Cloudflare Universal SSL certificates only cover your apex domain and one level of subdomain." (Source: https://developers.cloudflare.com/ssl/troubleshooting/version-cipher-mismatch/)
In your case, the subdomain
www.test.mydomain.com is a multi-level subdomain, which is not covered by the Universal SSL certificate. This is why you're seeing the error "ERR_SSL_VERSION_OR_CIPHER_MISMATCH" when trying to access this subdomain.The warning "This hostname is not covered by a certificate. Learn more." is also expected behavior, as Cloudflare is indicating that the subdomain is not covered by a certificate.
To resolve this issue, you can consider ordering an Advanced Certificate or uploading a Custom Certificate that covers the subdomain. (Source: https://developers.cloudflare.com/ssl/edge-certificates/additional-options/total-tls/error-messages/)
I hope this helps clarify the issue and provides a possible solution.
Sources
Feedback
Feedback has been submitted! Thank you :)
This is an AI generated response, it may not be 100% accurate. Please validate the output. You can ask followups by replying to this message or mentioning me.
CNo because that only matches the first level domain.
Matching is performed using the matching rules specified byhttps://www.ietf.org/rfc/rfc2818.txt
[RFC2459]. If more than one identity of a given type is present in
the certificate (e.g., more than one dNSName name, a match in any one
of the set is considered acceptable.) Names may contain the wildcard
character * which is considered to match any single domain name
component or component fragment. E.g.,*.a.commatches foo.a.com but
not bar.foo.a.com.f*.commatches foo.com but not bar.com.
CYeah that is the best way
RUnfortunately yeah; the dashboard shows a warning sign next to the proxies DNS records informing you of this as well
