1

I have a website running on https://www.example.org/ I intend to create the http://games.example.com/ [without SSL].

I am running Apache 2 on Ubuntu 16 server.

I want the subdomain to remain http and the main domain to remain https. What should I do?

At the moment the settings are as it follows:

000-default.conf:

<VirtualHost *:80>
    ServerName www.example.com
    Redirect permanent "/" "https://www.example.com/"
    #SSLProtocol all -SSLv2 -SSLv3
    ServerAdmin [email protected]
    DocumentRoot /var/www/html
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>
<VirtualHost *:80>
    ServerName games.example.com
    ServerAdmin [email protected]
    DocumentRoot /var/www/games
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>
<VirtualHost *:80>
    ServerName planets.example.com
    ServerAdmin [email protected]
    DocumentRoot /var/www/2moons
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

default-ssl/conf:

<IfModule mod_ssl.c>
<VirtualHost _default_:443>
                            ServerAdmin [email protected]
                            ServerName www.example.com

                            DocumentRoot /var/www/html

                            ErrorLog ${APACHE_LOG_DIR}/error.log
                            CustomLog ${APACHE_LOG_DIR}/access.log combined

                            SSLEngine on

                            SSLCertificateFile      /etc/ssl/certs/certificate.crt
                            SSLCertificateKeyFile /etc/ssl/private/private.key

                            <FilesMatch "\.(cgi|shtml|phtml|php|jpg)$">
                                                            SSLOptions +StdEnvVars
                            </FilesMatch>
                            <Directory /usr/lib/cgi-bin>
                                                            SSLOptions +StdEnvVars
                            </Directory>

                            BrowserMatch "MSIE [2-6]" \
                                                         nokeepalive ssl-unclean-shutdown \
                                                         downgrade-1.0 force-response-1.0

</VirtualHost>
</IfModule>
9
  • 1
    What issues are you having? Are you able to access http://games.example.com/, or does something not work when you try?
    – ceejayoz
    Nov 2, 2018 at 14:45
  • @ceejayoz this happens. prntscr.com/ldlc3w
    – Alphabetus
    Nov 2, 2018 at 14:52
  • Are you saying that going to the http://games.example.com/ URL does a redirect to https://games.example.com/? Because I can get to http://games.followarmy.com/ without any issues. I can't get to the HTTPS version, because you don't have an SSL certificate for it. That's how things are supposed to work.
    – ceejayoz
    Nov 2, 2018 at 14:55
  • 1
    It works fine here; says "TEST" in all caps. Try clearing your caches; if the URL was at some previous point returning a permanent redirect, your browser will have cached that.
    – ceejayoz
    Nov 2, 2018 at 14:59
  • 3
    Why don't you just get certificates for the subdomains or extend your certificate to include all subdomains? Since your are already using Let's Encrypt there is absolutely no reason not to use SSL. Nov 2, 2018 at 15:32

1 Answer 1

14

Given that the domain in question seems to be followarmy.com I've tried to access http://games.followarmy.com/, which works first. But when accessing https://followarmy.com then http://games.followarmy.com/ does not work anymore. The reason is that https://followarmy.com set HSTS for the domain:

Strict-Transport-Security: max-age=63072000; includeSubdomains

Since includeSubdomains is set any future visits to http://games.... will be automatically rewritten by the browser to https://games..... But, when trying to access the site with https it will fail since the subject of the certificate does not match the site. For more information on the HSTS header see the documentation.

Note that this information can not be seen from the incomplete configuration you show. It can also not be seen from this configuration that your SSL setup is broken. Instead if sending the leaf certificate and the necessary intermediate certificate from Let's Encrypt you are sending only your leaf certificate. For more details see the ssllabs report.

5
  • exactly. how do i fix it?
    – Alphabetus
    Nov 2, 2018 at 15:09
  • @AlphabetoPT: given that you don't show the relevant part of the configuration where you set the header it is impossible to say how exactly the fix should look like. But obviously you should not use the includeSubdomains attribute for the header if you don't want to include subdomains. Note that you need clear the cache of the browser again after you've made the change and before retesting and all others which already visited your site and got the wrong HSTS header need to do this too. Nov 2, 2018 at 15:13
  • i managed to get SSL working hardly. can you please tell me how to disable the includeSubdomains?
    – Alphabetus
    Nov 2, 2018 at 15:16
  • 1
    Oooh, nice catch.
    – ceejayoz
    Nov 2, 2018 at 15:20
  • 2
    @AlphabetoPT: The HSTS header does not get set automatically. Somewhere in your configuration it is explicitly set, something like here. It is not set in the subset of the (edited) configuration you show here so I'm unable to point you to the exact position in the config. You need to look through your full configuration yourself to find and fix this header. Nov 2, 2018 at 15:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .