Community Custom Domain with SSL Error: NET::ERR_CERT_COMMON_NAME_INVALID

Question

BACKGROUND

We have a Salesforce Community with a custom domain and SSL certificate installed.

But when I do an SSL check on the site, I get this warning:

The certificate is not trusted in all web browsers. You may need to install an Intermediate/chain certificate to link it to a trusted root certificate. You can fix this by following DigiCert's Certificate Installation Instructions for your server platform. Pay attention to the parts about Intermediate certificates.

Common name: subdomain.example.com

SANs: subdomain.example.com

Valid from May 16, 2018 to May 16, 2020

Serial Number: XXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Signature Algorithm: sha256WithRSAEncryption

Issuer: RapidSSL RSA CA 2018

Obviously, I cannot install a Intermediate/chain certificate on the Salesforce servers...

But when I asked Salesforce support for help, they told me this was a developer issue, and to ask the developer community...

QUESTION

Why is this happening?

How can I fix it?

---

NOTE: I cannot publish the actual domain name publicly, but if anyone is willing to help debug, I will share privately.

Answer 1

The problem you're experiencing my be related to the following Knowledge Article on Salesforce certificates change from Symantec to DigiCert in January and February 2018. Here's a relevant snippet from the last update to the KA:

NOTE: Salesforce has completed certificate rotations according to the schedule below, in January and February of 2018. We will continue to rotate any other affected Salesforce certificates prior to March 15 and September 13, 2018 to meet Google Chrome version 66 (M66) and Chrome version 70 (M70) requirements. We do not anticipate that there will be any impact to customers with these rotations in March and September, however, you may see warnings about expiration of some of these certificates like this example, “The SSL certificate used to load resources from https://a.sfdcstatic.com will be distrusted in M70. Once distrusted, users will be prevented from loading these resources. See https://g.co/chrome/symantecpkicerts for more information.”