Combining Wildcard and Regular Certificates

Help
21

In case anyone else comes across this, I followed some instructions I got online and added this to the virtual host file and it seems to work.

<Directory /var/www/exemple.com>
Options Indexes FollowSymLinks MultiViews
AllowOverride All
Order allow,deny
allow from all

This is what it said in my -le.conf file:

RewriteEngine on

Some rewrite rules in this file were disabled on your HTTPS site
because they have the potential to create redirection loops.

RewriteCond %{SERVER_NAME} =example.com [OR]
RewriteCond %{SERVER_NAME} =www.example.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

22

I think it's missing quite a bit. Also, for readability, it's best for those kind of pieces of "code" to put it between three backticks (```) on its own line above and below the code.

This isn't going to put a redirect in place as far as I know? Is this complete?

23

Oh yeah I left out the other virtual host code that was already there.

anyway, it did seem to work, but after I realized what I was looking at I changed it to this:

RewriteCond %{SERVER_NAME} =example.com [OR]
RewriteCond %{SERVER_NAME} =www.example.com [OR]
RewriteCond %{SERVER_NAME} =mail.example.com

RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

And it still works so perhaps I'll just leave it like that...

24

I'm assuming your mail subdomain has its own <VirtualHost> section? If so, the redirect code should also be in that <VirtualHost> section. I assume those two RewriteCond statements were in your websites <VirtualHost> section?

25

This is "squirrelmail-le-ssl.conf"
(I added periods before the comments to prevent big bold text here in the post)
(and spaces in the < )

< IfModule mod_ssl.c>
< VirtualHost *:443>

ServerName mail.example.com
DocumentRoot /var/www/html/wordpress/squirrelmail

RewriteEngine on
.# Some rewrite rules in this file were disabled on your HTTPS site,
.# because they have the potential to create redirection loops.

.# RewriteCond %{SERVER_NAME} =example.com [OR]
.# RewriteCond %{SERVER_NAME} =www.example.com
.# RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem

this is in my original squirrelmail.conf virtual host file

< VirtualHost *:80>

ServerName mail.example.com
DocumentRoot /var/www/html/wordpress/squirrelmail

RewriteEngine on
RewriteCond %{SERVER_NAME} =example.com [OR]
RewriteCond %{SERVER_NAME} =www.example.com [OR]
RewriteCond %{SERVER_NAME} =mail.example.com [OR]
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

.# <Directory /var/www/html/wordpress>
.# Options Indexes FollowSymLinks MultiViews
.# AllowOverride All
.# Order allow,deny
.# allow from all
.# < /Directory>

< /VirtualHost>

26

Well, it looks sort of OK now.. The RewriteCond for example.com and www.example.com aren't really necessary in this VirtualHost, as it's just for mail.example.com. But it probably doesn't harm too.. I don't know how they ended up in your squirrelmail.conf in the first place though.. Perhaps you copied it from your websites conf when you set up squirrelmail? In that case, I think certbot didn't add the redirect, because it probably thought there already was a redirect in place.. Albeit being the incorrect one :stuck_out_tongue:

27

I'll see how it goes.

One thing I noticed is when I go to "www.example.com" it redirects to "example.com" - it doesn't really matter and it might have been doing that before and I just didn't notice it.

", I think certbot didn't add the redirect, because it probably thought there already was a redirect in place.. Albeit being the incorrect one "

Oh I see, interesting. Well this whole exercise is a learning endeavor for me so this has been good education. thx!

28

That's your WordPress doing. Currently, your redirects are as follows:

HTTP www.example.com -- certbot -> HTTPS www.example.com -- WordPress -> HTTPS example.com

29

This is my current "examplecom.conf" main wordpress site file

<VirtualHost *:80>

ServerName www.example.com
ServerAlias example.com
DocumentRoot /var/www/html/wordpress

RewriteEngine on
RewriteCond %{SERVER_NAME} =example.com [OR]
RewriteCond %{SERVER_NAME} =www.example.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

30

Looks exactly like the redirect code certbot has or would have added.. And that's the first part of the two redirects. The second part is handled in the WordPress PHP code.

31

I agree, it should probably be more like:
a certificate SAN entry for *.example.com

32

Feel free to comment on my PR about that.

33

@_az and I have expanded the glossary definition of the wildcard certificate . Hopefully this explanation is more clear for future readers @ShaneH!