A look at matthewsvolvosite.com certificate details shows "jnerate.com certificate name does not match input".
jnerate.com is a domain i use occasionally for general purposes, but is not important to me. It does run on the same server, same IP. matthewsvolvosite.com is important to me.
How do I 'un-nest' matthewsvolvosite.com from jnerate.com ?
www.matthewsvolvosite.com works ok, and always has.
My domain is: matthewsvolvosite.com
I ran this command: don't know
It produced this output: don't know
My web server is (include version): nginx 1.14.2
The operating system my web server runs on is (include version): Debian 10
My hosting provider, if applicable, is:
I can login to a root shell on my machine (yes or no, or I don't know): yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): 1.29.0
1 Like
Osiris
August 6, 2022, 7:41pm
2
Sounds like your nginx configuration is incorrect. Please show the output of the command (with three backticks above and below (these ones: ```) the output please):
sudo nginx -T
4 Likes
Thanks for the reply, Osiris.
nginx: [warn] conflicting server name "matthewsvolvosite.com" on 0.0.0.0:443, ignored
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
# configuration file /etc/nginx/nginx.conf:
user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;
events {
worker_connections 1024;
multi_accept on;
}
http {
##
# Basic Settings
##
sendfile on;
tcp_nopush on;
tcp_nodelay on;
client_body_buffer_size 80M;
# the above line to stop [warn] an upstream response is buffered to a temporary file /var/lib/nginx/fastcgi... in nginx logs
# proxy_buffers 32 32k;
# proxy_buffer_size 32k;
# proxy_buffering off; #it's not working here
proxy_buffer_size 32k; # should be enough for most PHP websites, or adjust as above
proxy_busy_buffers_size 40k; # essentially, proxy_buffer_size + 2 small buffers of 4k
proxy_buffers 64 4k; # should be enough for most PHP websites, adjust as above to get an accurate value
keepalive_timeout 300;
keepalive_requests 500;
send_timeout 30;
# types_hash_max_size 2048;
# server_tokens off;
#MATT
fastcgi_buffers 8 48k;
fastcgi_buffer_size 128k;
fastcgi_connect_timeout 30;
fastcgi_send_timeout 30;
fastcgi_read_timeout 30;
proxy_read_timeout 300;
proxy_connect_timeout 30;
proxy_send_timeout 30;
# server_names_hash_bucket_size 64;
# server_name_in_redirect off;
include /etc/nginx/mime.types;
default_type application/octet-stream;
##
# SSL Settings
##
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
ssl_prefer_server_ciphers on;
##
# Logging Settings
##
# access_log on;
# access_log /var/log/nginx/access.log;
#error_log /var/log/nginx/error.log;
error_log /var/log/nginx/error.log error;
rewrite_log off;
##
# Gzip Settings
##
gzip on;
gzip_vary off;
gzip_proxied any;
gzip_min_length 1000;
#gzip_proxied expired no-cache no-store private auth;
#gzip_types text/plain application/x-javascript text/xml text/css application/xml;
gzip_comp_level 9;
gzip_buffers 16 8k;
gzip_http_version 1.1;
gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
##
# Virtual Host Configs
##
include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*;
log_format main_ext
'$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for" '
'"$host" sn="$server_name" '
'rt=$request_time '
'ua="$upstream_addr" us="$upstream_status" '
'ut="$upstream_response_time" ul="$upstream_response_length" '
'cs=$upstream_cache_status' ;
# access_log /var/log/nginx/access.log main_ext;
access_log off;
}
#mail {
# # See sample authentication script at:
# # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
#
# # auth_http localhost/auth.php;
# # pop3_capabilities "TOP" "USER";
# # imap_capabilities "IMAP4rev1" "UIDPLUS";
#
# server {
# listen localhost:110;
# protocol pop3;
# proxy on;
# }
#
# server {
# listen localhost:143;
# protocol imap;
# proxy on;
# }
#}
# configuration file /etc/nginx/modules-enabled/50-mod-http-auth-pam.conf:
load_module modules/ngx_http_auth_pam_module.so;
# configuration file /etc/nginx/modules-enabled/50-mod-http-dav-ext.conf:
load_module modules/ngx_http_dav_ext_module.so;
# configuration file /etc/nginx/modules-enabled/50-mod-http-echo.conf:
load_module modules/ngx_http_echo_module.so;
# configuration file /etc/nginx/modules-enabled/50-mod-http-geoip.conf:
load_module modules/ngx_http_geoip_module.so;
# configuration file /etc/nginx/modules-enabled/50-mod-http-image-filter.conf:
load_module modules/ngx_http_image_filter_module.so;
# configuration file /etc/nginx/modules-enabled/50-mod-http-subs-filter.conf:
load_module modules/ngx_http_subs_filter_module.so;
# configuration file /etc/nginx/modules-enabled/50-mod-http-upstream-fair.conf:
load_module modules/ngx_http_upstream_fair_module.so;
# configuration file /etc/nginx/modules-enabled/50-mod-http-xslt-filter.conf:
load_module modules/ngx_http_xslt_filter_module.so;
# configuration file /etc/nginx/modules-enabled/50-mod-mail.conf:
load_module modules/ngx_mail_module.so;
# configuration file /etc/nginx/modules-enabled/50-mod-stream.conf:
load_module modules/ngx_stream_module.so;
# configuration file /etc/nginx/mime.types:
types {
text/html html htm shtml;
text/css css;
text/xml xml;
image/gif gif;
image/jpeg jpeg jpg;
application/javascript js;
application/atom+xml atom;
application/rss+xml rss;
text/mathml mml;
text/plain txt;
text/vnd.sun.j2me.app-descriptor jad;
text/vnd.wap.wml wml;
text/x-component htc;
image/png png;
image/tiff tif tiff;
image/vnd.wap.wbmp wbmp;
image/x-icon ico;
image/x-jng jng;
image/x-ms-bmp bmp;
image/svg+xml svg svgz;
image/webp webp;
application/font-woff woff;
application/java-archive jar war ear;
application/json json;
application/mac-binhex40 hqx;
application/msword doc;
application/pdf pdf;
application/postscript ps eps ai;
application/rtf rtf;
application/vnd.apple.mpegurl m3u8;
application/vnd.ms-excel xls;
application/vnd.ms-fontobject eot;
application/vnd.ms-powerpoint ppt;
application/vnd.wap.wmlc wmlc;
application/vnd.google-earth.kml+xml kml;
application/vnd.google-earth.kmz kmz;
application/x-7z-compressed 7z;
application/x-cocoa cco;
application/x-java-archive-diff jardiff;
application/x-java-jnlp-file jnlp;
application/x-makeself run;
application/x-perl pl pm;
application/x-pilot prc pdb;
application/x-rar-compressed rar;
application/x-redhat-package-manager rpm;
application/x-sea sea;
application/x-shockwave-flash swf;
application/x-stuffit sit;
application/x-tcl tcl tk;
application/x-x509-ca-cert der pem crt;
application/x-xpinstall xpi;
application/xhtml+xml xhtml;
application/xspf+xml xspf;
application/zip zip;
application/octet-stream bin exe dll;
application/octet-stream deb;
application/octet-stream dmg;
application/octet-stream iso img;
application/octet-stream msi msp msm;
application/vnd.openxmlformats-officedocument.wordprocessingml.document docx;
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet xlsx;
application/vnd.openxmlformats-officedocument.presentationml.presentation pptx;
audio/midi mid midi kar;
audio/mpeg mp3;
audio/ogg ogg;
audio/x-m4a m4a;
audio/x-realaudio ra;
video/3gpp 3gpp 3gp;
video/mp2t ts;
video/mp4 mp4;
video/mpeg mpeg mpg;
video/quicktime mov;
video/webm webm;
video/x-flv flv;
video/x-m4v m4v;
video/x-mng mng;
video/x-ms-asf asx asf;
video/x-ms-wmv wmv;
video/x-msvideo avi;
}
# configuration file /etc/nginx/conf.d/stub_status.conf:
server {
listen 127.0.0.1:80;
server_name 127.0.0.1;
location /nginx_status {
stub_status on;
allow 127.0.0.1;
deny all;
}
}
# configuration file /etc/nginx/sites-enabled/jnerate.com:
#server {
# listen 80;
# listen [::]:80;
# root /var/www/jnerate.com;
# index index.php index.html index.htm;
# server_name jnerate.com;
# location / {
# try_files $uri $uri/ =404;
# }
# location ~ \.php$ {
# include snippets/fastcgi-php.conf;
# fastcgi_pass unix:/var/run/php/php7.3-fpm.sock;
# }
#}
# Upstream to abstract backend connection(s) for php
#upstream php {
# server unix:/tmp/php-cgi.socket;
# server 127.0.0.1:9000;
#}
server {
# SSL configuration
#
# listen 443 ssl default_server;
# listen [::]:443 ssl default_server;
#
# Note: You should disable gzip for SSL traffic.
# See: https://bugs.debian.org/773332
#
# Read up on ssl_ciphers to ensure a secure configuration.
# See: https://bugs.debian.org/765782
#
# Self signed certs generated by the ssl-cert package
# Don't use them in a production server!
#
# include snippets/snakeoil.conf;
root /var/www/jnerate.com;
# Add index.php to the list if you are using PHP
index index.html index.htm index.nginx-debian.html index.php;
server_name jnerate.com; # managed by Certbot
client_max_body_size 500M;
error_log off;
access_log off;
log_not_found off;
# listen [::]:80;
# allow 97.118.139.45;
# allow 71.33.144.150;
allow 71.33.149.107;
allow 2607:fb90::/32;
allow 71.33.157.225;
allow 174.29.254.6;
allow 97.118.186.246;
# deny all;
# for certbot renewals, important
location ~ /.well-known {
allow all;
}
location / {
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.
# Matt commented this out to allow for the following lines:
# try_files $uri $uri/ =404;
# This is cool because no php is touched for static content.
# include the "?$args" part so non-default permalinks doesn't break when using query string
# try_files $uri $uri/ /index.php?$args;
# deny all;
}
location /nginx_status {
stub_status on;
allow 127.0.0.1;
allow 71.33.149.107;
allow 2607:fb90::/32;
deny all;
}
# for phpmyadmin login
location /pmaz {
auth_basic "Admin Login";
auth_basic_user_file /etc/nginx/pma_pass;
try_files $uri $uri/ /index.php?$args;
}
# pass PHP scripts to FastCGI server
#
location ~ \.php$ {
include snippets/fastcgi-php.conf;
#
# # With php-fpm (or other unix sockets):
fastcgi_pass unix:/run/php/php8.1-fpm.sock;
# # With php-cgi (or other tcp sockets):
# fastcgi_pass 127.0.0.1:9000;
# fastcgi_intercept_errors on;
# fastcgi_buffers 8 16k;
# fastcgi_buffer_size 32k;
fastcgi_connect_timeout 900;
fastcgi_send_timeout 900;
fastcgi_read_timeout 900;
}
location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
expires max;
log_not_found off;
}
# deny access to .htaccess files, if Apache's document root
# concurs with nginx's one
#
#location ~ /\.ht {
# deny all;
#}
# listen 80;
# listen [::]:80;
listen [::]:443 ssl; # managed by Certbot
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/jnerate.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/jnerate.com/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
server {
if ($host = jnerate.com) {
return 301 https://$host$request_uri;
} # managed by Certbot
server_name jnerate.com;
listen 80;
listen [::]:80;
return 404; # managed by Certbot
}
# configuration file /etc/nginx/snippets/fastcgi-php.conf:
# regex to split $uri to $fastcgi_script_name and $fastcgi_path
fastcgi_split_path_info ^(.+?\.php)(/.*)$;
# Check that the PHP script exists before passing it
try_files $fastcgi_script_name =404;
# Bypass the fact that try_files resets $fastcgi_path_info
# see: http://trac.nginx.org/nginx/ticket/321
set $path_info $fastcgi_path_info;
fastcgi_param PATH_INFO $path_info;
fastcgi_index index.php;
include fastcgi.conf;
# configuration file /etc/nginx/fastcgi.conf:
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
fastcgi_param REQUEST_URI $request_uri;
fastcgi_param DOCUMENT_URI $document_uri;
fastcgi_param DOCUMENT_ROOT $document_root;
fastcgi_param SERVER_PROTOCOL $server_protocol;
fastcgi_param REQUEST_SCHEME $scheme;
fastcgi_param HTTPS $https if_not_empty;
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
fastcgi_param REMOTE_ADDR $remote_addr;
fastcgi_param REMOTE_PORT $remote_port;
fastcgi_param SERVER_ADDR $server_addr;
fastcgi_param SERVER_PORT $server_port;
fastcgi_param SERVER_NAME $server_name;
# PHP only, required if PHP was built with --enable-force-cgi-redirect
fastcgi_param REDIRECT_STATUS 200;
# configuration file /etc/letsencrypt/options-ssl-nginx.conf:
# This file contains important security parameters. If you modify this file
# manually, Certbot will be unable to automatically provide future security
# updates. Instead, Certbot will print and log an error message with a path to
# the up-to-date file that you will need to refer to when manually updating
# this file. Contents are based on https://ssl-config.mozilla.org
ssl_session_cache shared:le_nginx_SSL:10m;
ssl_session_timeout 1440m;
ssl_session_tickets off;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
# configuration file /etc/nginx/sites-enabled/matthewsvolvosite.com:
# Upstream to abstract backend connection(s) for php
upstream php {
server unix:/tmp/php-cgi.socket;
server 127.0.0.1:9000;
}
server {
listen 80;
listen 443; # new
server_name matthewsvolvosite.com;
return 301 https://www.matthewsvolvosite.com$request_uri;
}
server {
listen [::]:443 ssl http2 ipv6only=on;
listen 443 ssl http2;
server_name matthewsvolvosite.com www.matthewsvolvosite.com tst.matthewsvolvosite.com;
root /var/www/matthewsvolvosite.com/html/;
add_header Strict-Transport-Security "max-age=6000; includeSubDomains" always;
# add_header Content-Security-Policy "default-src 'self';" always;
add_header X-Frame-Options "SAMEORIGIN";
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
# proxy_request_buffering off;
# rewrite_log on;
error_log /var/log/nginx/error.log error;
# access_log /var/log/nginx/access.log;
client_max_body_size 256M;
error_page 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 421 422 423 424 425 426 428 429 431 451 500 501 502 503 504 505 506 507 508 510 511 /404/;
#MATT for fixing old forum path
# location /chat/phpBB/ {
# rewrite ^/(.*)$ /forums/$1 last;
# }
# fix index.php white screen of death by redirecting to (whatever)/
if ($request_uri ~* "^(.*/)index\.php$") {
return 301 $1;
}
#MATT for phpbb
location /forums/ {
index index.php index.html index.htm;
fastcgi_buffer_size 8K;
fastcgi_buffers 64 8k;
try_files $uri $uri/ @rewriteapp;
location ~ /(config\.php|common\.php|cache|files|images/avatars/upload|includes|(?<!ext/)phpbb|store|vendor) {
deny all;
}
rewrite ^profile\.php\?mode=editprofile$ https://www.matthewsvolvosite.com/forums/ucp.php?i=ucp_profile&mode=profile_info redirect;
rewrite ^viewforum.php?f=20$ https://www.matthewsvolvosite.com/forums/viewforum.php?f=4 redirect;
location ~ \.php(/|$) {
include snippets/fastcgi-php.conf;
fastcgi_param SCRIPT_FILENAME $request_filename;
fastcgi_param HTTP_PROXY '';
# try_files $uri $uri/ /app.php$is_args$args $document_root$fastcgi_script_name =404;
fastcgi_pass unix:/var/run/php/php7.3-fpm.sock;
}
}
location / {
index index.php index.html index.htm;
#try_files $uri $uri/ =404;
#try_files $uri $uri/ /index.php?$args;
#try_files $uri $uri/ /index.php?q=$uri&$args;
try_files $uri $uri/ /index.php$is_args$args;
}
location = /forums/viewforum.php?f=20 {
return https://www.matthewsvolvosite.com/forums/viewforum.php?f=4;
}
location = /forums/viewforum.php?f=22 {
return 301 https://www.matthewsvolvosite.com/forums/viewforum.php?f=6;
}
location = /forums/viewforum.php?f=37 {
return 301 https://www.matthewsvolvosite.com/forums/viewforum.php?f=4;
}
location = /forums/viewforum.php?f=27 {
return 301 https://www.matthewsvolvosite.com/forums/viewforum.php?f=4;
}
location = /chat/phpBB2 {
return 301 https://www.matthewsvolvosite.com/forums/;
}
location ~* /chat/phpBB2/viewtopic\.php(.*)$ {
rewrite ^ /forums/viewtopic.php permanent;
}
location ~* \.(?:ico|css|js|gif|jpe?g|png)$ {
expires 30d;
add_header Vary Accept-Encoding;
access_log off;
}
location ~* \.css$ {
expires 30d;
add_header Vary Accept-Encoding;
access_log off;
}
location = /favicon.ico {
log_not_found off;
access_log off;
}
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
location ~* \.(?:rss|atom)$ {
#try_files $uri /index.php?$query_string;
expires 8h;
add_header Cache-Control "public";
}
location ~ \.php$ {
include fastcgi_params;
include snippets/fastcgi-php.conf;
fastcgi_pass unix:/var/run/php/php8.1-fpm.sock;
fastcgi_buffer_size 8K;
fastcgi_buffers 64 8k;
fastcgi_keep_conn on;
}
location ~ /forums/memberlist\.php\?mode=contactadmin$ {
rewrite https://www.matthewsvolvosite.com/contact/ permanent;
}
# for phpmyadmin login
location /pmaz {
auth_basic "Admin Login";
auth_basic_user_file /etc/nginx/pma_pass;
fastcgi_read_timeout 219;
# break;
include fastcgi_params;
include snippets/fastcgi-php.conf;
fastcgi_pass unix:/var/run/php/php8.1-fpm.sock;
}
location @rewriteapp {
rewrite ^(.*)$ /forums/app.php/$1 last;
}
location ^\/ac_page(.*)$ {
return https://www.matthewsvolvosite.com/volvo-air-conditioning-problems-and-fixes/;
}
# rewrite ^\/ac_page(.*)$ https://www.matthewsvolvosite.com/volvo-air-conditioning-problems-and-fixes/ permanent;
# if we're coming back to this, re-enable the cron check for updates
# listen [::]:443 ssl ipv6only=on; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/matthewsvolvosite.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/matthewsvolvosite.com/privkey.pem; # managed by Certbot
# include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
# configuration file /etc/nginx/fastcgi_params:
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
fastcgi_param REQUEST_URI $request_uri;
fastcgi_param DOCUMENT_URI $document_uri;
fastcgi_param DOCUMENT_ROOT $document_root;
fastcgi_param SERVER_PROTOCOL $server_protocol;
fastcgi_param REQUEST_SCHEME $scheme;
fastcgi_param HTTPS $https if_not_empty;
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
fastcgi_param REMOTE_ADDR $remote_addr;
fastcgi_param REMOTE_PORT $remote_port;
fastcgi_param SERVER_ADDR $server_addr;
fastcgi_param SERVER_PORT $server_port;
fastcgi_param SERVER_NAME $server_name;
# PHP only, required if PHP was built with --enable-force-cgi-redirect
fastcgi_param REDIRECT_STATUS 200;
2 Likes
Osiris
August 6, 2022, 8:04pm
4
I think nginx is complaining about and is confused due to the double listen 443; for matthewsvolvosite.com. You probably want to remove:
instamattic:
listen 443; # new
And try again.
Also, you don't have any HTTP site set up for www.matthewsvolvosite.com or tst.matthewsvolvosite.com, just for matthewsvolvosite.com. You probably want to add the www subdomain to the HTTP server block too.
4 Likes
You probably want to remove listen 443;
Ok, makes sense.
Also, you don't have any HTTP site set up for www.matthewsvolvosite.com or tst.matthewsvolvosite.com , just for matthewsvolvosite.com . You probably want to add the www subdomain to the HTTP server block too.
Could you re-phrase that? I don't understand.
1 Like
Osiris
August 6, 2022, 9:58pm
6
Your HTTP server block shown below:
Is missing www.matthewsvolvosite.com (and tst.matthewsvolvosite.com if that's relevant), so there won't be a HTTP to HTTPS redirect for www.matthewsvolvosite.com.
5 Likes
That worked, thanks so much. I messed it up months ago trying to get non-www -> www redirects working, and now I'm back at that problem, but I think it's a better problem to have than the certificate problem.
EDIT: the non-www -> www nonfunctionality problem only happening in the forum pages ("/forums")
2 Likes
Update: I solved the www problem with good old php. Not elegant, but it works, so hey...
Thanks again, Osiris.
3 Likes
system
September 5, 2022, 11:31pm
9
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.