0

I have a domain ambroise-rabier.fr and like to add a domain analytics.ambroise-rabier.fr, also in https.

On chrome I get privacy error, unless I duplicate ambroise-rabier.fr value in each server_name key. But then nginx complain with conflicting server name "ambroise-rabier.fr".

Here is the config:

server {
        listen 80;
        listen [::]:80;
        server_name ambroise-rabier.fr www.ambroise-rabier.fr analytics.ambroise-rabier.fr;

        location ~ /.well-known/acme-challenge {
          allow all;
          root /var/www/html;
        }

        location / {
                rewrite ^ https://$host$request_uri? permanent;
        }
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name ambroise-rabier.fr www.ambroise-rabier.fr;

    server_tokens off;

    ssl_certificate /etc/letsencrypt/live/ambroise-rabier.fr/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/ambroise-rabier.fr/privkey.pem;

    ssl_buffer_size 8k;

    ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;

    ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
    ssl_prefer_server_ciphers on;

    ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;

    ssl_ecdh_curve secp384r1;
    ssl_session_tickets off;

    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8;


    location / {
        # ...
    }

    root /var/www/html/blog-front/dist/blog-front;
    index index.html index.htm index.nginx-debian.html;
}

# See also https://www.digitalocean.com/community/tutorials/how-to-secure-a-containerized-node-js-application-with-nginx-let-s-encrypt-and-docker-compose
# Se also https://github.com/matomo-org/matomo-nginx/blob/master/sites-available/matomo.conf
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name ambroise-rabier.fr analytics.ambroise-rabier.fr;

    server_tokens off;

    ssl_certificate /etc/letsencrypt/live/ambroise-rabier.fr/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/ambroise-rabier.fr/privkey.pem;

    ssl_buffer_size 8k;

    ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;

    ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
    ssl_prefer_server_ciphers on;

    ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;

    ssl_ecdh_curve secp384r1;
    ssl_session_tickets off;

    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8;

    root /var/www/html/matomo;

    index index.php;

    # make sure outgoing links don't show the URL to the Matomo instance
    add_header Referrer-Policy origin; 

    location / {
        # ...
    }

}
# vim: filetype=nginx

Again, if I remove ambroise-rabier.fr from server_name ambroise-rabier.fr analytics.ambroise-rabier.fr;, the nginx configuration doesn't throw any warning. But I get privacy error on Chrome (that is worse). With my current workaround I suspect some resources might not be loading well on analytics.ambroise-rabier.fr due to the duplicate server_name. And there also should be a correct way to achieve this.

I am using docker and Let's Encrypt certificate (followed digital ocean tutorial), I use this command: certonly --webroot --webroot-path=/var/www/html --email my.email@host.fr --agree-tos --no-eff-email --force-renewal -d ambroise-rabier.fr -d www.ambroise-rabier.fr -d analytics.ambroise-rabier.fr .

The output of this command:

ambroise@vps318592:~/node_project$ docker-compose up certbot
db is up-to-date
nodejs is up-to-date
webserver is up-to-date
Recreating certbot ... done
Attaching to certbot
certbot      | Saving debug log to /var/log/letsencrypt/letsencrypt.log
certbot      | Plugins selected: Authenticator webroot, Installer None
certbot      | Renewing an existing certificate
certbot      | IMPORTANT NOTES:
certbot      |  - Congratulations! Your certificate and chain have been saved at:
certbot      |    /etc/letsencrypt/live/ambroise-rabier.fr/fullchain.pem
certbot      |    Your key file has been saved at:
certbot      |    /etc/letsencrypt/live/ambroise-rabier.fr/privkey.pem
certbot      |    Your cert will expire on 2019-09-19. To obtain a new or tweaked
certbot      |    version of this certificate in the future, simply run certbot
certbot      |    again. To non-interactively renew *all* of your certificates, run
certbot      |    "certbot renew"
certbot      |  - If you like Certbot, please consider supporting our work by:
certbot      |
certbot      |    Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
certbot      |    Donating to EFF:                    https://eff.org/donate-le
certbot      |
certbot exited with code 0
2

Sounds like SSL certificate issue. Can you check the SAN in your certificate whether analytics.ambroise-rabier.fr is there? try adding option --expand when you generate the certificate.

--expand tells Certbot to update an existing certificate with a new certificate that contains all of the old domains and one or more additional new domains. With the --expand option, use the -d option to specify all existing domains and one or more new domains.

source: https://certbot.eff.org/docs/using.html#re-creating-and-updating-existing-certificates

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.