-1

I bought an SSL certificate from SSLMate and it's working fine on my Nginx server when I access http://example.com, but not when I access http:// www.example.com

I believe the problem has to do with the way I entered the CNAME. Here's a pic: https://i.imgur.com/mgwp2DY.png

The certificate I bought on SSLMate states that a www certificate works for both www and non-www, so I think I filled out the CNAME wrong. I'm trying to get http://www. and https://www. to 301 redirect to https:// example.com

Here's my Nginx config:

server {
    server_name examplesite.com;
    #rewrite https://examplesite.com$request_uri? permanent;
    return 301 https://examplesite.com$request_uri;
}

server {
    listen 443 ssl;
    ssl on;
    ssl_certificate /etc/sslmate/www.examplesite.com.chained.crt;
    ssl_certificate_key /etc/sslmate/www.examplesite.com.key;

    server_name examplesite.com;

    root /home/garrett/domains/examplesite.com/public_html;
    access_log /home/garrett/domains/examplesite.com/logs/access.log;
    error_log /home/garrett/domains/examplesite.com/logs/error.log;

    index index.php index.html index.htm;
    error_page 404 /404.php;
    error_page 403 /404.php;

    location / {
        #try_files $uri $uri/ /index.php;
    }

    location ~* .(jpg|jpeg|png|gif|ico|css|js)$ {
        expires max;
    }


    location ~ \.php$ {
        try_files $uri =404;
        fastcgi_pass unix:/var/run/php5-fpm-garrett.sock;
        include fastcgi_params;
    }

    location ~ /\.ht {
        deny all;
    }
}

Adding www.examplesite.com to server_name in the first block breaks everything.

  • Why don't you give us the actual domain so we can take a look? – ceejayoz Jan 18 '16 at 22:05
0

Some suggestions:

  • Use the openssl command line tool review the contents of your certificate. Confirm that it really supports both domains. If so, it may use SNI to do this. Check your SNI support.
  • Break the problem down into smaller problems to start with. Create 4 server {} blocks: One for "http://www", one for "https://www", one for for "https://no-www" and one for "http://no-www". Then each configuration will be as small and simple as possible. Get them working one by one. Once you are done, you can look for patterns and maybe go back and combine them.

Here's the alternate approach I use, which also simplifies Nginx configuration: It's important to support-and-redirect the "www" subdomain and it's important to support SSL, but it's not important to support the unlikely combination that someone both manually enters the "www" subdomain and that they manually entered "https://" as well. So I don't support that fourth variation. Across over a dozen production sites, this has not been an issue. So that eliminates the need for the second SSL certificate and well as possible issues with SNI support.

Next, I don't support "www" in my local Nginx configuration. Instead, I use the "HTTP Redirect" feature of my DNS provider. I use DNS Made Easy, but this is a popular feature that several DNS providers over. By entering the "HTTP Redirect" record with them for the "www" subdomain, the DNS resolves to their web servers, and they handle the configuration and redirection of the *www" subdomain for me.

All I'm left to handle is the simple case of redirecting non-SSL to SSL for the main domain.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.