SOLVED: RemoteCertificateNameMismatch

[Raúl Casado Piqueras]

Yes, i think so.

When I do and insecure curl, I can see the request in the nginx logs:

Code:

# curl -vvv https://image.tmdb.org/t/p/original/uqIVJR1fmkiwpcIsIcV0vxiyY4z.jpg -o /tmp/futurama.jpg -k
  % Total    % Received % Xferd  Average Speed  Time    Time    Time  Current
                                Dload  Upload  Total  Spent    Left  Speed
  0    0    0    0    0    0      0      0 --:--:--  0:00:03 --:--:--    0*  Trying 185.93.2.251:443...
* Connected to image.tmdb.org (185.93.2.251) port 443 (#0)
* ALPN: offers h2,http/1.1
} [5 bytes data]
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]
* TLSv1.3 (IN), TLS handshake, Server hello (2):
{ [122 bytes data]
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
{ [25 bytes data]
* TLSv1.3 (IN), TLS handshake, Certificate (11):
{ [2038 bytes data]
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
{ [79 bytes data]
* TLSv1.3 (IN), TLS handshake, Finished (20):
{ [52 bytes data]
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
} [1 bytes data]
* TLSv1.3 (OUT), TLS handshake, Finished (20):
} [52 bytes data]
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN: server accepted http/1.1
* Server certificate:
*  subject: CN=valid.domain.com
*  start date: Sep 19 19:38:02 2024 GMT
*  expire date: Dec 18 19:38:01 2024 GMT
*  issuer: C=US; O=Let's Encrypt; CN=E6
*  SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
* using HTTP/1.1
} [5 bytes data]
> GET /t/p/original/uqIVJR1fmkiwpcIsIcV0vxiyY4z.jpg HTTP/1.1
> Host: image.tmdb.org
> User-Agent: curl/7.88.1
> Accept: */*
>
{ [5 bytes data]
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
{ [281 bytes data]
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
{ [281 bytes data]
* old SSL session ID is stale, removing
* Empty reply from server
  0    0    0    0    0    0      0      0 --:--:--  0:00:04 --:--:--    0
* Closing connection 0
} [5 bytes data]
* TLSv1.3 (OUT), TLS alert, close notify (256):
} [2 bytes data]
curl: (52) Empty reply from server

The nginx access.log output:

Code:

172.24.0.1 - - [25/Oct/2024:21:42:32 +0000] "GET /t/p/original/uqIVJR1fmkiwpcIsIcV0vxiyY4z.jpg HTTP/1.1" 444 0 "-" "curl/7.88.1"