0

I have encryption from lets encrypt which is working fine. My configuration of Nginx allows only SSL connections. www.example.com, example.com, blog.example.com - all are working fine.

The problems

is if a type www1.example.com or blog12.example.com- there is an error : Your connection is not secure

I've read that is related to wildcard certificates - but let's encrypt doesn't support yet.

Question

is it possible to change configuration to get server not found error instead of Your connection is not secure for those "mistyped" sub-domains?

Info

  • lets encrypt call

    sudo letsencrypt certonly -a webroot --webroot-path=/var/www/html -d example.com -d www.example.com

  • /etc/nginx/sites-available/example

    server {
        listen 80 default_server;
        listen [::]:80 default_server;
        server_name example.com www.example.com;
        return 301 https://$server_name$request_uri;
    }
    
    server {
    
        # SSL configuration
    
        listen 443 ssl http2 default_server;
        listen [::]:443 ssl http2 default_server;
        include snippets/ssl-example.com.conf;
        include snippets/ssl-params.conf;```
    
        . . .
    
3
  • 1
    It is not possible. – Orphans Mar 28 '17 at 5:48
  • So the only way I guess is to allow normal connection (wihtout SSL). Is it harmful to leave it as it is now? – Vanko Mar 28 '17 at 5:50
  • Please see the answer from @duskwuff. That explains why you propably have that issue. This issue can't be solved on the server thou. – Orphans Mar 28 '17 at 6:11
2

This is a DNS problem.

Your problem is that DNS lookups for blog12.example.com (for example) are returning the IP of your web server, instead of returning a NXDOMAIN response. This is probably because you have a wildcard DNS record set up.

To rectify this situation, go to your DNS provider and:

  1. Create an A record for each subdomain that you want to have working (e.g, www.example.com, blog.example.com, etc), with the same IP as the current wildcard record.

  2. Delete the wildcard record.

2
  • So I've finished was with 2 A records - example.com; blog.example.com; 2 C recrods www.example.com ; *.example.com ; Now I have 3 A records - example.com; blog.example.com; www.example.com and no C records. It's still not updated the DNS. Most probably tonight I'll give a feedback. Thanx again. – Vanko Mar 28 '17 at 6:57
  • Cool. It's working perfect. – Vanko Mar 28 '17 at 18:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.