1

I'd like to be able to create a subdomain in Nginx Reverse proxy. As it stands right now, I have a properly configured and usable reverse proxy that resolves properly. The problem arises when I try to get it to play nice with an apache server that I need multiple subdomains for. I'd like to create a subdomain such as johnsmith.example.com. My main domain example.com points to an apache2 server, which is currently up, pinging, and loads the default apache page. I'm currently unable to figure out the necessary reverse proxy configuration to point the reverse proxy to the subdomain properly. Am I supposed to create separate site-enabled configurations for the subdomain, as I have with example.com.conf? Or do I need to add subdomain configuration inside of example.com.conf in /etc/nginx/sites-available?

Here is the nginx reverse proxy example.com.conf in /etc/nginx/sites-available (changed names for domains, assume everything EXCEPT for johnsmith.example.com resolves and is set up properly. Also ignore SSL stuff, as this isn't a certbot oriented problem/question):

#example.com
server {
    listen                  443;# ssl http2;
    listen                  [::]:443;# ssl http2;
    server_name             example.com;

    # reverse proxy
    location / {
        proxy_pass "http://internal.DNS.URL";
        include    nginxconfig.io/proxy.conf;
    }

    # additional config
    include nginxconfig.io/general.conf;
}

# HTTP redirect
server {
    listen      80;
    listen      [::]:80;
    server_name example.com;
    include     nginxconfig.io/letsencrypt.conf;

    location / {
        return 301 https://example.com$request_uri;
    }
}


##johnsmith.example.com
server {
    listen                  443;# ssl http2;
    listen                  [::]:443;# ssl http2;
    server_name             johnsmith.example.com;


    # security
    include                 nginxconfig.io/security.conf;

    # reverse proxy
    location / {
        proxy_pass "internal.DNS.URL";
        include    nginxconfig.io/proxy.conf;
    }

    # additional config
    include nginxconfig.io/general.conf;
}

# HTTP redirect
server {
    listen      80;
    listen      [::]:80;
    server_name johnsmith.example.com;
    include     nginxconfig.io/letsencrypt.conf;

    location / {
        return 301 https://johnsmith.example.com$request_uri;
    }
}

Note: I have created a seperate configuration (/etc/nginx/sites-available/johnsmith.example.com.conf) and it did not work. This is just what I've tried last.

My DNS record for this subdomain is:

Type: CNAME Record | Host: johnsmith | Target: example.com
Type: CNAME Record | Host: www.johnsmith | Target: example.com

Like I've said above, assume everything resolves except for this particular subdomain. Please let me know what other information would be useful for solving this problem.

Thank you for your time.

Edit: Output of curl -v https://johnsmith.example.com

Expire in 3 ms for 1 (transfer 0x55f7da933e00)
* Expire in 3 ms for 1 (transfer 0x55f7da933e00)
* Expire in 4 ms for 1 (transfer 0x55f7da933e00)
*   Trying 97.113.101.68...
* TCP_NODELAY set
* Expire in 200 ms for 4 (transfer 0x55f7da933e00)
* Connected to johnsmith.example.com (97.113.101.68) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use h2
* Server certificate:
*  subject: CN=jellyfin.example.com
*  start date: Jan  3 20:38:41 2021 GMT
*  expire date: Apr  3 20:38:41 2021 GMT
*  subjectAltName does not match johnsmith.example.com
* SSL: no alternative certificate subject name matches target host name 'johnsmith.example.com'
* Closing connection 0
curl: (60) SSL: no alternative certificate subject name matches target host name 'johnsmith.example.com'
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

6
  • What is the output of curl -v https://johnsmith.example.com? Feb 28, 2021 at 19:35
  • Updated my post @TeroKilkanen Mar 3, 2021 at 18:13
  • Please add output of curl -v https://johnsmith.example.com, not output of curl -v johnsmith.example.com. Mar 3, 2021 at 19:06
  • @TeroKilkanen edited output to reflect https://johnsmith.example.com. Very interesting output this time. I am immediately curious about why my jellyfin server's cert comes up in the output. gonna have to poke around there as well... Mar 5, 2021 at 3:49
  • Do you have a symbolic link from /etc/nginx/sites-available/example.com.conf to /etc/nginx/sites-enabled/example.com.conf? Mar 5, 2021 at 7:30

1 Answer 1

0

This isn't going to be the most helpful answer, but I got johnsmith.example.com to resolve, and I DO NOT KNOW what small change brought it about (but this setup does work for the bare-bones domain->subdomain.domain->subdomain.domain->etc structure that I needed it for) . I'll try to share my setup so that anyone coming to this question can see what worked for me and for correct syntax for subdomains in /etc/nginx/sites-available/{websitename}.conf. Hopefully this will be helpful to someone. Huge thank you to @Tero Kilkanen for getting me to dig around a bit through the output of various commands.

This is without the SSL section which will be added later, so if you are using certbot you'll obviously need the SSL cert field info. nginxconfig.io is a great tool/site for looking at a nice nginx reverse proxy template , and it's what I used, and includes the fields for SSL. Moving on...

From /etc/nginx/sites-available/example.com.conf

#example.com
server {
    listen                  443;# ssl http2;
    listen                  [::]:443;# ssl http2;
    server_name             example.com;

    # reverse proxy
    location / {
        proxy_pass "http://internal.DNS.URL";
        include    nginxconfig.io/proxy.conf;
    }

    # additional config
    include nginxconfig.io/general.conf;
}

# HTTP redirect
server {
    listen      80;
    listen      [::]:80;
    server_name example.com;
    include     nginxconfig.io/letsencrypt.conf;

    location / {
        return 301 https://example.com$request_uri;
    }
}


##johnsmith.example.com
server {
    listen                  443;# ssl http2;
    listen                  [::]:443;# ssl http2;
    server_name             johnsmith.example.com;


    # security
    include                 nginxconfig.io/security.conf;

    # reverse proxy
    location / {
        proxy_pass "internal.DNS.URL";
        include    nginxconfig.io/proxy.conf;
    }

    # additional config
    include nginxconfig.io/general.conf;
}

# HTTP redirect
server {
    listen      80;
    listen      [::]:80;
    server_name johnsmith.example.com;
    include     nginxconfig.io/letsencrypt.conf;

    location / {
        return 301 https://johnsmith.example.com$request_uri;
    }
}

I deleted the CNAME records for johnsmith.example and www.johnsmith.example, because apparently a wildcard *.example.com CNAME record I had added at an earlier time for a nextcloud install was sufficient (I'm pretty new at DNS, I know this one is probably very obvious).

One other thing, I have an internal DNS (dnsmasq) in the proxy_pass section. Here is the block in question:

 # reverse proxy
    location / {
        proxy_pass "internal.DNS.URL";
        include    nginxconfig.io/proxy.conf;

This works for me, but you'd need to put in an IP address there instead if you didn't have an internal DNS server.

Again big thanks for @TeroKilkanen for helping me with this problem.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .