0

I have a problem with wildcard certificates for a subdomain. I wish to have one certificate for the domain example.com and the same cert for the same level of subdomains *.example.com.

The problem is the subdomain return SSL cert error: SSL_ERROR_BAD_CERT_DOMAIN on the connection.

I'm using OVH as a host of domains.

This is a link for a similar Nginx configuration: CONFIG that I used.

That's certbot command that I'm using for generating certs: certbot': sudo certbot certonly --preferred-challenges dns --dns-ovh --dns-ovh-credentials /etc/nginx/ovh-credentials.ini -d 'example.com,*.example.com'

[nginx.conf]

# Generated by nginxconfig.io

user                 www-data;
pid                  /run/nginx.pid;
worker_processes     auto;
worker_rlimit_nofile 65535;

events {
    multi_accept       on;
    worker_connections 65535;
}

http {
    charset              utf-8;
    sendfile             on;
    tcp_nopush           on;
    tcp_nodelay          on;
    server_tokens        off;
    log_not_found        off;
    types_hash_max_size  2048;
    client_max_body_size 16M;

    # MIME
    include              mime.types;
    default_type         application/octet-stream;

    # Logging
    access_log           /var/log/nginx/access.log;
    error_log            /var/log/nginx/error.log warn;

    # SSL
    ssl_session_timeout  1d;
    ssl_session_cache    shared:SSL:10m;
    ssl_session_tickets  off;

    # Diffie-Hellman parameter for DHE ciphersuites
    ssl_dhparam          /etc/nginx/dhparam.pem;

    # Mozilla Intermediate configuration
    ssl_protocols        TLSv1.2 TLSv1.3;
    ssl_ciphers          ***************

    # OCSP Stapling
    ssl_stapling         on;
    ssl_stapling_verify  on;
    resolver             1.1.1.1 1.0.0.1 8.8.8.8 8.8.4.4 208.67.222.222 208.67.220.220 valid=60s;
    resolver_timeout     2s;

    # Load configs
    include              /etc/nginx/conf.d/*.conf;
    include              /etc/nginx/sites-enabled/*;
}

[general.conf]

    # favicon.ico
location = /favicon.ico {
    log_not_found off;
    access_log    off;
}

# robots.txt
location = /robots.txt {
    log_not_found off;
    access_log    off;
}

# assets, media
location ~* \.(?:css(\.map)?|js(\.map)?|jpe?g|png|gif|ico|cur|heic|webp|tiff?|mp3|m4a|aac|ogg|midi?|wav|mp4|mov|webm|mpe?g|avi|ogv|flv|wmv)$ {
    expires    7d;
    access_log off;
}

# svg, fonts
location ~* \.(?:svgz?|ttf|ttc|otf|eot|woff2?)$ {
    add_header Access-Control-Allow-Origin "*";
    expires    7d;
    access_log off;
}

# gzip
gzip              on;
gzip_vary         on;
gzip_proxied      any;
gzip_comp_level   6;
gzip_types        text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml;

[letsencrypt.conf]

# ACME-challenge
location ^~ /.well-known/acme-challenge/ {
    root /var/www/_letsencrypt;
}

[php_fastcgi.conf]

# 404
try_files                     $fastcgi_script_name =404;

# default fastcgi_params
include                       fastcgi_params;

# fastcgi settings
fastcgi_pass                  unix:/var/run/php/php7.4-fpm.sock;
fastcgi_index                 index.php;
fastcgi_buffers               8 16k;
fastcgi_buffer_size           32k;

# fastcgi params
fastcgi_param DOCUMENT_ROOT   $realpath_root;
fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
fastcgi_param PHP_ADMIN_VALUE "open_basedir=$base/:/usr/lib/php/:/tmp/";

[security.conf]

# security headers
add_header X-Frame-Options           "SAMEORIGIN" always;
add_header X-XSS-Protection          "1; mode=block" always;
add_header X-Content-Type-Options    "nosniff" always;
add_header Referrer-Policy           "no-referrer-when-downgrade" always;
add_header Content-Security-Policy   "default-src 'self' http: https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline' fonts.googleapis.com stackpath.bootstrapcdn.com;" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header Feature-Policy "geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;camera none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none;" always;

# . files
location ~ /\.(?!well-known) {
    deny all;
}

[example.com.conf]

# define error page
error_page 403 = @notfound;
error_page 404 = @notfound;

server {
    listen                  443 ssl http2;
    server_name             example.com;
    set                     $base /srv/www/example;
    root                    $base/;

    # SSL
    ssl_certificate /etc/letsencrypt/live/example.com-0002/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/example.com-0002/privkey.pem; # managed by Certbot
    ssl_trusted_certificate /etc/letsencrypt/live/example.com-0002/chain.pem;

    # security
    include                 nginxconfig.io/security.conf;

    # index.php
    index                   index.php;

    # index.php fallback
    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    # additional config
    include nginxconfig.io/general.conf;

    # handle .php
    location ~ \.php$ {
        include nginxconfig.io/php_fastcgi.conf;
    }

    # error page location redirect 302
    location @notfound {
        return 302 /;
    }
}

# non-www, subdomains redirect
#server {
#    listen                  443 ssl http2;
#    server_name             .example.com;
#
#    # SSL
#    ssl_certificate /etc/letsencrypt/live/example.com-0002/fullchain.pem;
#    ssl_certificate_key /etc/letsencrypt/live/example.com-0002/privkey.pem;
#    ssl_trusted_certificate /etc/letsencrypt/live/example.com-0002/chain.pem;
#    return 301 https://www.example.com$request_uri;
#}

# HTTP redirect
server {
    listen 80;
    server_name www.example.com; #default_server;
    include nginxconfig.io/letsencrypt.conf;

    location / {
        return 301 https://www.example.com$request_uri;
    }
}

[a.example.com.conf]

server {
    listen      443 ssl http2;
    server_name a.example.com;
    set         $base /srv/www/a.example;
    root        $base/;

    # SSL
    ssl_certificate /etc/letsencrypt/live/example.com-0002/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/example.com-0002/privkey.pem; # managed by Certbot
    ssl_trusted_certificate /etc/letsencrypt/live/example.com-0002/chain.pem;

    # security
    include nginxconfig.io/security.conf;

    # index.php
    index index.php;

    # index.php fallback
    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    # additional config
    include nginxconfig.io/general.conf;

    # handle .php
    location ~ \.php$ {
        include nginxconfig.io/php_fastcgi.conf;
    }
}

# non-www, subdomains redirect
#server {
#    listen      443 ssl http2;
#    server_name .a.example.com;
#
#    # SSL
#    ssl_certificate /etc/letsencrypt/live/example.com-0002/fullchain.pem; # managed by Certbot
#    ssl_certificate_key /etc/letsencrypt/live/example.com-0002/privkey.pem; # managed by Certbot
#    ssl_trusted_certificate /etc/letsencrypt/live/example.com-0002/chain.pem;
#    return 301 https://www.a.example.com$request_uri;
#}

# HTTP redirect
#server {
#    listen  80;
#    include nginxconfig.io/letsencrypt.conf;
#
#    location / {
#        return 301 https://a.example.com$request_uri;
#    }
#}

P.S. when I open the browser and show cert at a.example.com I've got a message this certificate is for https://www.a.example.com/www.example.com

A secure connection could not be established: the domain name requested does not match the server certificate.

UPDATE: Problem is when a.example.com will be redirected to www.a.example.com, so certificate for https://a.example.com is valid but not for https://www.a.example.com. I have no idea how to fix it.

user25392
  • 1
  • 1
  • You're generating a certificate for `example.com` and `a.example.com` based on the command you provided so don't expect any other `example.com` subdomains to work with. – Ginnungagap Jul 01 '20 at 10:39
  • S**t, miss typing error, I was thinking about `*.example.com`. @Ginnungagap thanks for paying attention. Updated! – user25392 Jul 01 '20 at 10:46
  • Can you post **your** configuration instead of someone else's which works? If the certificate generation doesn't error out, it's likely you configuration at fault. – Ginnungagap Jul 01 '20 at 10:53
  • @Ginnungagap sure, give me couple min for it please. – user25392 Jul 01 '20 at 10:59
  • You're not asking for `*.example.com`, your asking for `www.a.example.com` which is in `*.a.example.com`. Edit: it seems I got this the wrong way around based on what you describe, it appears this should be right (and impossible given the certbot invocation) but the obfuscation makes it impossible to actually get accurate information for ourselves so ‍♂️ – Ginnungagap Jul 01 '20 at 12:06
  • @Ginnungagap you can replace example whatever you want, I've changed only the name to example. Configs are the same as for production. But as you can see certificate will point to the `https://www.a.example.com/www.example.com` – user25392 Jul 01 '20 at 12:35
  • Could you add a screenshot where `https://www.a.example.com/www.example.com` string is visible? – Tero Kilkanen Jul 01 '20 at 16:57
  • @TeroKilkanen this problem was removed it was on a hyperlink, but the main problem still exists - certificate for domains like `*.example` is not valid with subdomain `a.example.com` – user25392 Jul 01 '20 at 18:33

0 Answers0