Why does a site without HTTPS at all have some kind of left non-working certificate, and not only mine, but also others?

Question

Apache HTTP Server

Background:
Bought a certificate. I put it through apache.
Apache starts without errors, but when you try to log in, all possible clients give out "Not protected" and some left issuer of the certificate: Internet Widgits Pty Ltd, although I took it in a completely different place, besides, that certificate expired long ago and it was registered when I didn't fix anything.

I put a free certificate with letsencrypt's certbot, the same story.

History:
Here I configure Apache back to port 80 and disable SSL in it, and then stop it altogether ... And - lo and behold - nothing changes in browsers when visiting https: // the site does not change!

I decided to explore other sites, both my own and others', without any HTTPS.
And what?
3 out of 5 sites have the same hat! Issuers are different everywhere, somewhere the certificate has not yet expired, but, as we can see, they do not work.
Only 2 sites show timeout or refused instead of a hat.

Why is this?
How right?

- "Proper SSL configuration in Apache should stupidly cover this hat"? (but why doesn't it throw an error if it's wrong) Do I have to wait after apache SSL is configured and rebooted, or should it be instant?

- Or "it needs to be somehow removed in DNS "?

How exactly?

Answer 1

start with decomposition
everything will come down to one question the
answer is CORRECTLY put a certificate for a SPECIFIC domain

Answer 2

https://habrahabr.ru/post/320164/

Answer 3

Widgits is the "default certificate" for demonstrating the possibilities that https works at all . The fact that there are people who then do not remove this certificate and do not replace it with a normal one is the problem of these people :)