0

For some reason, when I navigate to http://mydomain.me/s1, I get a Your connection isn't private warning, with NET::ERR_CERT_COMMON_NAME_INVALID and subject: homeassistant.mydomain.me < a subdomain that has it's own server config.

But I expect to see the website at 127.0.0.1:8081, as when I go to chivers.me/ and see the website at 127.0.0.1:8080

Why is this happening?

mydomain.me:

server {
    listen 80 ;
    server_name mydomain.me;

    location / {
        proxy_pass http://127.0.0.1:8080/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location /s1/ {
        proxy_pass http://127.0.0.1:8081/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

homeassistant.mydomain.me:

map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

server {
    server_name homeassistant.mydomain.me;
    listen 80;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name homeassistant.mydomain.me;

    ssl_certificate /etc/letsencrypt/live/homeassistant.mydomain.me/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/homeassistant.mydomain.me/privkey.pem;
    ssl_dhparam /etc/nginx/ssl/dhparams.pem;

    add_header Strict-Transport-Security "max-age=31536000; includeSubdomains";
    
    ssl_protocols TLSv1.2;
    ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;

    proxy_buffering off;

    location / {
        proxy_pass http://my-home-assistant.url:8123;
        proxy_set_header Host $host;
        proxy_redirect http:// https://;
        proxy_http_version 1.1;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }
}

subdom1.mydomain.me:

server {
    listen 80;
    server_name subdom1.mydomain.me;

    location / {
        proxy_pass http://another-url.co.uk/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}
Matthew
  • 267
  • 1
  • 14
  • The answers are in your certificate - but you provided no details of how that was provisioned (`openssl x509 -noout -text -in fullchain.pem`). It looks as if the certificate does not include the sub-domain. – symcbean Feb 23 '21 at 19:30
  • I think you may have misunderstood. I am attempting to reach `http://mydomain.me` on a standard `http` (no ssl) connection. It is somehow redirecting to `https://mydomain.me` and giving me an issue that "the configured certificate" (there should be none) is for `homeassistant.mydomain.me`. That certificate _is_ the only certificate I've got installed - because `homeassistant.mydomain.me` is the only connection I want set up for https/ssl! `mydomain.me` should just remain as a `http` connection, so why is a connection to `mydomain.me` pulling in a certificate for `homeassistant.mydomain.me` – Matthew Feb 23 '21 at 20:12
  • Got you now. Looks like whatever is at http://127.0.0.1:8081/ is sending a redirect. Check in web developer tools – symcbean Feb 23 '21 at 23:40

0 Answers0