Fix storefront SSL probes and per-domain ensure for dashboards.

Skip redundant provision on edit, harden TLS hostname checks, and issue apex/business/customer SSL from one endpoint.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/common/tls-probe.ts

@@ -2,8 +2,22 @@ import * as tls from 'tls';
 
 const DEFAULT_TIMEOUT_MS = 2500;
 
+function peerMatchesHost(host: string, socket: tls.TLSSocket): boolean {
+  const cert = socket.getPeerCertificate();
+  if (!cert || Object.keys(cert).length === 0) {
+    return false;
+  }
+  try {
+    const err = tls.checkServerIdentity(host, cert);
+    return !err;
+  } catch {
+    return false;
+  }
+}
+
 /**
- * Live TLS check: connect to host:443 with SNI and require a trusted cert.
+ * Live TLS check: connect to host:443 with SNI and require a trusted cert
+ * whose identity matches the hostname (not merely a valid LE chain for another name).
  * Returns false on timeout, DNS failure, or cert/hostname errors.
  */
 export function probeTlsHost(
@@ -34,7 +48,9 @@ export function probeTlsHost(
           timeout: timeoutMs,
         },
         () => {
-          const ok = socket.authorized === true;
+          // authorized=true alone is not enough: a default vhost can present
+          // another site's valid cert (ERR_CERT_COMMON_NAME_INVALID in browsers).
+          const ok = socket.authorized === true && peerMatchesHost(host, socket);
           socket.destroy();
           finish(ok);
         },