I've been working for a while on a web application that has lived on two load-balanced DigitalOcean droplets (using a DigitalOcean loadbalancer, not my own load-balancing droplet) with SSL termination.
Up until now, the traffic has pointed to beta.mydomain.com, with an A record pointed to the load-balancer's IP. The load-balancer is set-up to do SSL-termination with an autogenerated SSL cert from Let's Encrypt.
The thing is that I'm moving out from beta so I wanted to change the site's URL to another subdomain (chile.mydomain.com). Thus, I:
1.- changed the basepath on my application to use the new domain (unrelated to this issue, but I mention it for the sake of completeness)
2.- created a new A record for the subdomain, pointed to the same LB
3.- reconfigured nginx (in both
sites-available) to listen for the new subdomain, checked everything with
nginx -t and restarted. This is working correctly, as the site actually responds when I browse to the new domain
If I browse to the new domain, I get an SSL error (invalid cert). I figured it was because I had previously set-up the original certificate for the base domain and the
beta subdomain as it can be seen in the cert's SAN section:
DNS Name=beta.mydomain.com DNS Name=mydomain.com
So, no biggie: re-create the HTTP2 rule on the LB and use the new subdomain so I get a new certificate for the new subdomain. And here's the issue: When I try to do this, I get an error stating:
No NS records found for mydomain.com domain.
This didn't happen in the previous beta subdomain. I tried adding NS records for the subdomain too (pointed to ns1, 2 and 3.digitalocean.com) with a small TTL and now the error reads:
one or more digitalocean name server not found for domain
So basically the DO control panel is refusing to generate a new certificate for the domain (which I purchased from namecheap as a registrar, pointed it to digitalocean months ago and haven't touched it) even though the domain is fully hosted at digitalocean
I'm totally lost now, being trying to figure this out for quite a while now. This puzzles me because the beta subdomain never had it's own NS records (the only NS records are for the base domain)
What am I missing here? I'm sure it's something really stupid, but I'm starting to grow desperate
Out of frustration I tried to spin a up a second, new, load balancer and experienced the exact same result. I even tried to set up SSL termination in the new LB for the beta subdomain which already works in the first LB (not the new subdomain) and got exactly the same message. I forgot to add that I already opened a ticket with DigitalOcean support but I've yet to receive a response.