Skip to main content
Version/Environment (if relevant): Applies to all version of Domino after browser update.

​
Issue:

After a Chrome update, Chromium-based browsers rejected the SSL certificate chain for the deployment, making it unreachable. The following error was displayed in the browser:

​
Root Cause:

Per AWS documentation, NET::ERR_CERT_COMMON_NAME_INVALID on an Application Load Balancer can have the following causes:
  • The domain name used in the HTTPS request does not match the alternate name specified in the listener’s associated AWS Certificate Manager (ACM) certificate.
  • The load balancer’s default DNS name is being used — public certificates cannot be issued for the *.amazonaws.com domain.
This error occurs when the browser cannot verify a website’s SSL certificate and is unable to establish a secure connection. It typically results from a misconfigured or incomplete certificate chain on the server. Per MinIO docs:
While the port 9000 is used for connecting to the API, MinIO automatically redirects browser access to the MinIO Console.
respond to S3 API operations on the default MinIO server port :9000 and browser access on the MinIO Console port :9090

​
Resolution:

In the Host field, replace the port number with 9000: Step 1: Extract the private key and certificate body from the .pfx file If you need to obtain the private key and certificate body from a .pfx file, run the following commands:
The first command outputs the private key to privatekey.pem. The second outputs the certificate body to certificate.pem. Step 2: Convert the certificate chain file to PEM format Run the following command to convert the .p7b file to PEM format:
This outputs the full certificate chain to certificates.pem. Step 3: Re-import the certificate into ACM
  1. Open the AWS Certificate Manager (ACM) console.
  2. Locate the existing certificate and select Reimport certificate.
  3. Paste the contents of certificates.pem into the Certificate chain field. Supply the certificate body and private key from Step 1 if prompted.
  4. Complete the import.

​
Notes/Information:

If changing the port to 9000 doesn’t resolve the issue, please open a Support ticket and send in the following output for the datasource-proxy pod. This requires the Admin to have kubectl access:
  1. Data Source Pod Status: kubectl -n <platform-namespace> get po —selector=app.kubernetes.io/name=datasource-proxy
  2. Data Source Logs: kubectl -n <platform-namespace> logs —selector=app.kubernetes.io/name=datasource-proxy -c datasource-proxy
  3. Data Source Proxy Pod describe: kubectl describe pod -n domino-platform <datasource-proxy-name>
Depending on the issue, Support may also ask for:
  1. Data Source Proxy Deployment: kubectl get deployment -n domino-platform datasource-proxy -o yaml
  2. Data Source Proxy Configure Map: kubectl get configmap -n domino-platform datasource-proxy -o yaml
  3. Data Source Proxy Service: kubectl get service datasource-proxy -n domino-platform -o yaml
Since the certificate was originally imported into ACM manually, ACM provides the option to re-import it with an updated certificate chain.

​
References/Internal Records:

  • New York Dept-Sanitation Zendesk ticket #80270
Last modified on October 12, 2026