Hi there,
I really need to learn more about encryption and server admin and meanwhile I am making noob mistakes.
My domain is: pequity.app
My web server is (include version): Nginx(1.14.0) + Gunicorn(20.0.4)
The operating system my web server runs on is (include version): Ubuntu 18.04
My hosting provider, if applicable, is: Digital Ocean
I can login to a root shell on my machine (yes or no, or I don’t know): yes
I’m using a control panel to manage my site (no, or provide the name and version of the control panel): no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot): 0.31.0
I successfully installed a cert for the www and non www versions using python - certbot - nginx (on 26.01.2020)
I have a Django - Vue app.
The Vue frontend is served by Nginx and the Django backend by Gunicorn + Nginx.
I am still developping the app and wanted to setup SSL on the server.
It’s a multi-tenants app and I added a test subdomain.
I found out about Let’s encrypt wildcard certs and decided it would be a better choice for me.
So I wasn’t sure how to go about this: do I delete the cert I issued a week ago?
Anyway, I just issued a wildcard cert and I ended up with 2 certs and all their files.
I issued the cert delete command, deleted the previous certs.
Then I renamed the letsencrypt dir to letsencryptold because it still had a dpharma file and some conf file and some dirs.
Now, if I go to the non-www version, click on the SSl icon, I can see it uses my second cert, the wildcard one.
The www version uses the first cert, although I have no idea where this one or his ghost lives (thought I nuked everything I could)
If I go to test.pequity.app (my test subdomain), I get a http 500 error.
Now the questions:
- Do I need to revoke a cert to completely get rid of it?
- Will my wildcard cert cover the www version too?
- is my DNS zone looking ok?
-
I add my tenants using Django shell. I setup a test tenant subdomain as test.pequity.app. Can this be more of a Django caused error or a SSL one?
-
Is it better to use CNAME to point www to non-www than to add 2 distinct A records? Will my cert work if I deleted that A record and used CNAME instead?
-
I created 2 server blocks that look very much the same, except for the name part. Is there something wrong in here?
server {
listen 80;
listen [::]:80;
root /var/www/pequity.app/html/frontend/dist/;
index index.html index.htm index.nginx-debian.html;
server_name test.pequity.app www.test.pequity.app;location = /favicon.ico {
access_log off; log_not_found off;
}location / { try_files $uri $uri/ /index.html; include proxy_params; proxy_pass http://unix:/run/gunicorn.sock; }location /static {
alias /var/www/pequity.app/html/backend/static;
}location /media {
alias /var/www/pequity.app/html/backend/media;
}location ^~ /api/ { # Define routes to be directed to backend as proxy
include proxy_params;
proxy_redirect off;
proxy_pass http://0.0.0.0:8000;
}location ^~ /admin {
include proxy_params;
proxy_redirect off;
proxy_pass http://0.0.0.0:8000;
}listen 443 ssl;
ssl_certificate /etc/letsencrypt/live/pequity.app/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/pequity.app/privkey.pem;
#include /etc/letsencrypt/options-ssl-nginx.conf;
#ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
}
Ending my saga here, hope I can get some clues.
Cheers,
Io
