Err_cert_common_name_invalid

Encrypt1919 · March 23, 2020, 5:20pm

@9peppe I think I’ve solved it by adding cors.conf to my landing page default.conf file, but I have an issue that my caching is not displayed:

location ^~ / {
    proxy_pass    http://landing;
    include       partials/common_location.conf;
    include       partials/cors.conf;
  }

//This si not working?? 
location ~* \.(ico|css|js|gif|jpeg|jpg|png|woff|ttf|otf|svg|woff2|eot)$ {
    expires 365d;
    add_header Cache-Control "public, no-transform";
   }

My curl request doesn’t contain expiration date?

9peppe · March 23, 2020, 5:25pm

You need to read the nginx documentation on the location directive, it will tell you when a block is invoked and when it is checked.

https://nginx.org/en/docs/http/ngx_http_core_module.html#location

Encrypt1919 · March 23, 2020, 5:38pm

So the problem is this:

If the longest matching prefix location has the “ ^~ ” modifier then regular expressions are not checked.

So my location is not being checked because it has this prefix do you know a workaround?

rg305 · March 23, 2020, 5:40pm

The ^~ implies don’t check any further.
So, order matters.
As ALL requests with match “/”, and it won’t look to match any further, the rest are essentially never used.

“If the longest matching prefix location has the “ ^~ ” modifier then regular expressions are not checked.”

rg305 · March 23, 2020, 5:46pm

I don't quite understand why these are defined to be included within a location section...

Encrypt1919 · March 23, 2020, 5:47pm

Here is my whole default.conf, I’ve put “location ~* .(ico|css|js|gif|jpeg|jpg|png|woff|ttf|otf|svg|woff2|eot)$” first but it still doesn’t work:

upstream rasa {
    #server  184.72.-187.19:5005;
#I had to this for port 5005 but not for landing because there default port is 80
    server   rasa:5005;
}
upstream landing {
    #server  184.72.187.19:8080;
    #server 127.0.0.1:8080;
    server   landing;
}

upstream server {
    #server  184.72.187.19:8080;
    #server 127.0.0.1:8080;
    server   server:9000;
}

server {
    listen       443 ssl;
    server_name  gotobot.co www.gotobot.co;
    # server_name  localhost;

    # @TODO remove for production
    #allow  127.0.0.1;
    #allow  83.71.213.166;
    #deny   all;

    #resolver 1.1.1.1 8.8.8.8 9.9.9.10;
    resolver 127.0.0.11 valid=30s;

    include       partials/common.conf;
    include       partials/ssl.conf;

    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }

    location ~* \.(ico|css|js|gif|jpeg|jpg|png|woff|ttf|otf|svg|woff2|eot)$ {
        expires 365d;
        add_header Cache-Control "public, no-transform";
   }

    location ^~ / {
        proxy_pass    http://landing;
        include       partials/common_location.conf;
        include       partials/cors.conf;
        #include       partials/common.conf;
        #include       partials/ssl.conf;
  }

   # location / {
   #     proxy_pass    http://api/webhooks/rest/webhook;
   #     include       partials/common_location.conf;
   #     include       partials/cors.conf;
   # }
    location = /hotel { rewrite ^ /hotel/ redirect; }
    location /hotel {
        #proxy_pass    http://rasa;
        rewrite /hotel/(.*) /$1 break;
        proxy_pass    http://rasa/webhooks/rest/webhook;
        include       partials/common.conf;
        #include       partials/ssl.conf;
        #proxy_set_header Accept '*/token';
  }


    location ^~ /server {
        proxy_pass    http://server/sendMail;
        include       partials/common.conf;
        #include       partials/ssl.conf;
  }

}

map $remote_addr $proxy_forwarded_elem {
    # IPv4 addresses can be sent as-is
    ~^[0-9.]+$          "for=$remote_addr";

    # IPv6 addresses need to be bracketed and quoted
    ~^[0-9A-Fa-f:.]+$   "for=\"[$remote_addr]\"";

    # Unix domain socket names cannot be represented in RFC 7239 syntax
    default             "for=unknown";
}

map $http_forwarded $proxy_add_forwarded {
    # If the incoming Forwarded header is syntactically valid, append to it
    "~^(,[ \\t]*)*([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?(;([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?)*([ \\t]*,([ \\t]*([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?(;([!#$%&'*+.^_`|~0-9A-Za-z-]+=([!#$%&'*+.^_`|~0-9A-Za-z-]+|\"([\\t \\x21\\x23-\\x5B\\x5D-\\x7E\\x80-\\xFF]|\\\\[\\t \\x21-\\x7E\\x80-\\xFF])*\"))?)*)?)*$" "$http_forwarded, $proxy_forwarded_elem";

    # Otherwise, replace it
    default "$proxy_forwarded_elem";
}

rg305 · March 23, 2020, 5:57pm

Well then it’s more than just “order matters”.
According to your current config, the longest match wins - no matter the order.
You need to understand “^~”, “~*”, when, and how, to use them.
[or maybe NOT to use them]

I see that several “partials” are used many times (in and out of locations).
I don’t understand that logic flow.
I also think you may be including content within the included content (looping).
[but that’s hard to see without the full config]
In short, if you don’t fully understand the problem, nor what some section of code is doing, don’t add that code to everything and everywhere (simply in an effort to fix a problem you don’t fully understand yet) - focus on understanding the problem.

Encrypt1919 · March 23, 2020, 6:24pm

You are right, I’ve removed the looping configs that occured while testing.

I’ve tried removing “^~” and the landing page doesn’t load then. I don’t understand honestly why I’m using “^~”, I’ve read that documentation but from it I still don’t grasp why do I need it.

Also, in the documentation there isn’t any workaround when I need to do this:

location ~* \.(ico|css|js|gif|jpeg|jpg|png|woff|ttf|otf|svg|woff2|eot)$ {
    expires 365d;
    add_header Cache-Control "public, no-transform";
   }

rg305 · March 23, 2020, 6:31pm

Try removing just the “^” from “^~”.
And having the “~*” line above the “~” line.
[images before root]

If that fails, try changing:
location ^~ / {
to
location / {
[again, keeping images first]

Encrypt1919 · March 23, 2020, 7:11pm

I’ve tried both but the page doesn’t load after those corrections…

location ~* \.(ico|css|js|gif|jpeg|jpg|png|woff|ttf|otf|svg|woff2|eot)$ {
    expires 365d;
    add_header Cache-Control "public, no-transform";
   }
location ~ / {
    proxy_pass    http://landing;

and

location  / {
    proxy_pass    http://landing;

rg305 · March 23, 2020, 8:00pm

This location has no document root nor does it proxy to another...
So, where does it get the content? (from default root?)

None of the pages work?

Can you hit http://landing/ locally?

9peppe · March 23, 2020, 8:19pm

they can, it's a docker network. landing is the actual hostname.

Encrypt1919 · March 23, 2020, 8:26pm

Yes, this is correct, so that is not the problem.

The landing page workes fine when I have this setup, its just that it doesn’t include this expire date when I make curl request or when testing with gtemetrix and similiar… @rg305

location ~* \.(ico|css|js|gif|jpeg|jpg|png|woff|ttf|otf|svg|woff2|eot)$ {
    expires 365d;
    add_header Cache-Control "public, no-transform";
   }

location ^~ / {
    proxy_pass    http://landing;
    include       partials/common_location.conf;
    include       partials/cors.conf;
    #include       partials/common.conf;
    #include       partials/ssl.conf;

rg305 · March 23, 2020, 10:25pm

Please be more specific on how this is being tested - or how to replicate the required test.
[Although it may seem obvious, I will make no assumptions]

Encrypt1919 · March 23, 2020, 10:29pm

I'm using this website: https://gtmetrix.com/

And I also double checked by making this curl request locally:

Here should be a category stating how long until the picture expires...

rg305 · March 23, 2020, 10:35pm

I can’t help test; from where I am I get:

curl -I -c - "https://www.gotobot.co/img/home_mob-min.8acf0c60.png" -k
curl: (7) Failed to connect to www.gotobot.co port 443: Connection refused

curl -Iki https://www.gotobot.co/
curl: (7) Failed to connect to www.gotobot.co port 443: Connection refused

Encrypt1919 · March 23, 2020, 10:41pm

I’ve stopped the docker containers, I’ve put them back up now.

rg305 · March 23, 2020, 10:41pm

I found an example that is using a slightly different syntax.
Try changing:
location ~* \.(ico|css|js|gif|jpeg|jpg|png|woff|ttf|otf|svg|woff2|eot)$ {
to
location ~* \.(?:ico|css|js|gif|jpeg|jpg|png|woff|ttf|otf|svg|woff2|eot)$ {

Encrypt1919 · March 23, 2020, 10:47pm

My nginx exits with this error:

Exit **Code 1** : Indicates failure due to application error.

rg305 · March 23, 2020, 11:37pm

Please show:
nginx -t