# Https://mydomain.org works but https://www.mydomain.org doesn't **URL:** \ **Category:** Help\ **Created:** [July 28, 2021, 10:41pm UTC](https://community.letsencrypt.org/t/https-mydomain-org-works-but-https-www-mydomain-org-doesnt/156706 "2021-07-28T22:41:01Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![gouessej](https://avatars.discourse-cdn.com/v4/letter/g/a6a055/32.png) [@gouessej](https://community.letsencrypt.org/u/gouessej)\ **Post date:** [July 28, 2021, 10:41pm UTC](https://community.letsencrypt.org/t/https-mydomain-org-works-but-https-www-mydomain-org-doesnt/156706/1 "2021-07-28T22:41:02Z")
My domain is: [commudaire.org](http://commudaire.org) I ran this command: certbot certonly --agree-tos -n -m $email --webroot -w /opt/web/mybase/webapps/commudaire.org -d [commudaire.org](http://commudaire.org) It produced this output: My web server is (include version): Jetty 11 The operating system my web server runs on is (include version): Debian Buster My hosting provider, if applicable, is: Gandi I can login to a root shell on my machine (yes or no, or I don't know): yes I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): certbot 1.17.0 Hello [https://commudaire.org](https://commudaire.org) works as expected but [https://www.commudaire.org](https://www.commudaire.org) doesn't work, I get the error SEC\_ERROR\_REVOKED\_CERTIFICATE. I set a redirect rule in my DNS zone but it doesn't help. Do I need to create a certificate supporting both [https://commudaire.org](https://commudaire.org) and [https://www.commudaire.org](https://www.commudaire.org) to make it work? If so, can I use the same web root for [https://commudaire.org](https://commudaire.org) and [https://www.commudaire.org](https://www.commudaire.org)? `certbot certonly --agree-tos -n -m $email --webroot -w /opt/web/mybase/webapps/commudaire.org -d commudaire.org -w /opt/web/mybase/webapps/commudaire.org -d www.commudaire.org` ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [July 28, 2021, 10:58pm UTC](https://community.letsencrypt.org/t/https-mydomain-org-works-but-https-www-mydomain-org-doesnt/156706/2 "2021-07-28T22:58:02Z")
The two sites are being hosted at two different IPs (using two different certs): ```nohighlight Name: commudaire.org Address: 80.13.94.99 Name: webredir.gandi.net Address: 217.70.184.56 Aliases: www.commudaire.org ``` ---
**Author:** ![gouessej](https://avatars.discourse-cdn.com/v4/letter/g/a6a055/32.png) [@gouessej](https://community.letsencrypt.org/u/gouessej)\ **Post date:** [July 29, 2021, 6:03am UTC](https://community.letsencrypt.org/t/https-mydomain-org-works-but-https-www-mydomain-org-doesnt/156706/3 "2021-07-29T06:03:41Z")
[https://www.commudaire.org](https://www.commudaire.org) uses a web redirection to [https://commudaire.org](https://commudaire.org) in the DNS zone, that's why you see [webredir.gandi.net](http://webredir.gandi.net). I wanted to simplify my deployment by having a single SSL certificate for [https://commudaire.org](https://commudaire.org), am I on the wrong way? Do I need two certificates, i.e one for the www subdomain and another one for the domain without subdomain? ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [July 29, 2021, 6:10am UTC](https://community.letsencrypt.org/t/https-mydomain-org-works-but-https-www-mydomain-org-doesnt/156706/4 "2021-07-29T06:10:17Z")
> [@gouessej](#): > > I wanted to simplify my deployment by having a single SSL certificate for [https://commudaire.org](https://commudaire.org), am I on the wrong way? No, continue. > [@gouessej](#): > > Do I need two certificates, i.e one for the www subdomain and another one for the domain without subdomain? As long as they are being hosted in separate systems, yes. The problem is that the "www" site now has a certificate that has been revoked: [SSL Server Test: www.commudaire.org (Powered by Qualys SSL Labs)](https://www.ssllabs.com/ssltest/analyze.html?d=www.commudaire.org) ---
**Author:** ![JimPas](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jimpas/32/33270_2.png) [@JimPas](https://community.letsencrypt.org/u/JimPas)\ **Post date:** [July 29, 2021, 6:51am UTC](https://community.letsencrypt.org/t/https-mydomain-org-works-but-https-www-mydomain-org-doesnt/156706/5 "2021-07-29T06:51:52Z")
What you did for your `www.commudaire.org` was to make it an alias of Gandi's hosting redirect without indicating your domain name in that path. Gandi is your registrar/hosting provider. You cannot create a cert for them. 🙂 Create a new certificate containing both `commudaire.org` and `www.commudaire.org` and use certbot to delete the original cert, or amend your existing cert by adding the www version of your domain. Use `80.13.94.99` as the IP for those. Last Result: [https://check-your-website.server-daten.de/?q=commudaire.org](https://check-your-website.server-daten.de/?q=commudaire.org) - 2021-07-29 07:38:26 Permalink: [https://check-your-website.server-daten.de/?i=ad461d98-19da-4810-a74f-1b5c41e96545](https://check-your-website.server-daten.de/?i=ad461d98-19da-4810-a74f-1b5c41e96545) ---
**Author:** ![gouessej](https://avatars.discourse-cdn.com/v4/letter/g/a6a055/32.png) [@gouessej](https://community.letsencrypt.org/u/gouessej)\ **Post date:** [July 29, 2021, 8:11am UTC](https://community.letsencrypt.org/t/https-mydomain-org-works-but-https-www-mydomain-org-doesnt/156706/6 "2021-07-29T08:11:19Z")
> [@JimPas](#): > > What you did for your `www.commudaire.org` was to make it an alias of Gandi's hosting redirect without indicating your domain name in that path. Gandi is your registrar/hosting provider. You cannot create a cert for them. 🙂 Should I remove the web redirection at least for https in this case? > [@JimPas](#): > > Create a new certificate containing both `commudaire.org` and `www.commudaire.org` and use certbot to delete the original cert, or amend your existing cert by adding the www version of your domain. Use `80.13.94.99` as the IP for those. > > Last Result: [https://check-your-website.server-daten.de/?q=commudaire.org](https://check-your-website.server-daten.de/?q=commudaire.org) - 2021-07-29 07:38:26 > Permalink: [commudaire.org - Make your website better - DNS, redirects, mixed content, certificates](https://check-your-website.server-daten.de/?i=ad461d98-19da-4810-a74f-1b5c41e96545) Is it the right way to create a single SSL certificate including the www version of my domain? `certbot certonly --agree-tos -n -m $email --webroot -w /opt/web/mybase/webapps/commudaire.org -d commudaire.org -w /opt/web/mybase/webapps/commudaire.org -d www.commudaire.org` I'd like to avoid using a wildcard certificate because it seems to be over-complicated for a single subdomain and it would drive my script not registrar agnostic (i.e the DNS plugins for Certbot are specific to the registrars). ---
**Author:** ![gouessej](https://avatars.discourse-cdn.com/v4/letter/g/a6a055/32.png) [@gouessej](https://community.letsencrypt.org/u/gouessej)\ **Post date:** [July 29, 2021, 8:13am UTC](https://community.letsencrypt.org/t/https-mydomain-org-works-but-https-www-mydomain-org-doesnt/156706/7 "2021-07-29T08:13:48Z")
> [@rg305](#): > > The problem is that the "www" site now has a certificate that has been revoked: > [SSL Server Test: www.commudaire.org (Powered by Qualys SSL Labs)](https://www.ssllabs.com/ssltest/analyze.html?d=www.commudaire.org) It was (probably?) automatically created by the Gandi system, I could only revoke it in its control panel. I'll ask Gandi to delete it. ---
**Author:** ![gouessej](https://avatars.discourse-cdn.com/v4/letter/g/a6a055/32.png) [@gouessej](https://community.letsencrypt.org/u/gouessej)\ **Post date:** [July 29, 2021, 8:26am UTC](https://community.letsencrypt.org/t/https-mydomain-org-works-but-https-www-mydomain-org-doesnt/156706/8 "2021-07-29T08:26:27Z")
I've just found this good example in the [documentation](https://certbot.eff.org/docs/using.html#webroot): `certbot certonly --webroot -w /var/www/example -d www.example.com -d example.com` It seems to do what I really want, a single web root, a single SSL certificate for the domain alone and the domain with the www subdomain. I'll give it a try as soon as possible. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [July 29, 2021, 1:33pm UTC](https://community.letsencrypt.org/t/https-mydomain-org-works-but-https-www-mydomain-org-doesnt/156706/9 "2021-07-29T13:33:49Z")
You would also need to update the DNS records to point only to your new IP. ---
**Author:** ![gouessej](https://avatars.discourse-cdn.com/v4/letter/g/a6a055/32.png) [@gouessej](https://community.letsencrypt.org/u/gouessej)\ **Post date:** [July 29, 2021, 2:14pm UTC](https://community.letsencrypt.org/t/https-mydomain-org-works-but-https-www-mydomain-org-doesnt/156706/10 "2021-07-29T14:14:23Z")
Do you mean that I have to add an A record for www pointing to my static public IP address? I plan to remove the CNAME record pointing to [webredir.gandi.net](http://webredir.gandi.net) and the web redirection as suggested by an employee of Gandi's customer service. I'll manage the redirection and rewriting rules carefully on my own. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [July 29, 2021, 2:20pm UTC](https://community.letsencrypt.org/t/https-mydomain-org-works-but-https-www-mydomain-org-doesnt/156706/11 "2021-07-29T14:20:26Z")
> [@gouessej](#): > > Do you mean that I have to add an A record for www pointing to my static public IP address? I don't know what you have, so I can't say with any certainty. But I know what I do see - two names returning two different IPs. HTTP validation will go to the IP resolved. (without correct redirection) That means you won't be able to validate both IPs from any one single IP. And I think that is where this fails - the redirection is incompatible with the expected. `http://www.commudaire.org/` redirects to `https://commudaire.org/`. Where `http://commudaire.org/` is expected. ---
**Author:** ![gouessej](https://avatars.discourse-cdn.com/v4/letter/g/a6a055/32.png) [@gouessej](https://community.letsencrypt.org/u/gouessej)\ **Post date:** [July 29, 2021, 5:19pm UTC](https://community.letsencrypt.org/t/https-mydomain-org-works-but-https-www-mydomain-org-doesnt/156706/12 "2021-07-29T17:19:18Z")
My zone file looks like this: ```nohighlight @ 86400 IN SOA ns1.gandi.net. hostmaster.gandi.net. 1627509973 10800 3600 604800 10800 @ 10800 IN A 80.13.94.99 @ 10800 IN MX 10 spool.mail.gandi.net. @ 10800 IN MX 50 fb.mail.gandi.net. @ 10800 IN TXT "v=spf1 include:_mailcust.gandi.net ?all" _imap._tcp 10800 IN SRV 0 0 0 . _imaps._tcp 10800 IN SRV 0 1 993 mail.gandi.net. _pop3._tcp 10800 IN SRV 0 0 0 . _pop3s._tcp 10800 IN SRV 10 1 995 mail.gandi.net. _submission._tcp 10800 IN SRV 0 1 465 mail.gandi.net. gm1._domainkey 10800 IN CNAME gm1.gandimail.net. gm2._domainkey 10800 IN CNAME gm2.gandimail.net. gm3._domainkey 10800 IN CNAME gm3.gandimail.net. webmail 10800 IN CNAME webmail.gandi.net. www 10800 IN CNAME webredir.gandi.net. ``` I've just removed the line causing a redirection to the parking page (the last one) and I've added an A record for www. Now, I get an error SSL\_ERROR\_BAD\_CERT\_DOMAIN. I need to add www into the single SSL certificate. ---
**Author:** ![gouessej](https://avatars.discourse-cdn.com/v4/letter/g/a6a055/32.png) [@gouessej](https://community.letsencrypt.org/u/gouessej)\ **Post date:** [July 29, 2021, 5:45pm UTC](https://community.letsencrypt.org/t/https-mydomain-org-works-but-https-www-mydomain-org-doesnt/156706/13 "2021-07-29T17:45:10Z")
> [@rg305](#): > > ```nohighlight > Name: webredir.gandi.net > Address: 217.70.184.56 > Aliases: www.commudaire.org > > ``` How can I programmaticly get this information? It would help me to indicate the user of my script that there's a parking page on her/his way. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [July 29, 2021, 5:51pm UTC](https://community.letsencrypt.org/t/https-mydomain-org-works-but-https-www-mydomain-org-doesnt/156706/14 "2021-07-29T17:51:21Z")
Using any DNS tool. Like: `dig` or `nslookup` ---
**Author:** ![gouessej](https://avatars.discourse-cdn.com/v4/letter/g/a6a055/32.png) [@gouessej](https://community.letsencrypt.org/u/gouessej)\ **Post date:** [July 30, 2021, 8:24pm UTC](https://community.letsencrypt.org/t/https-mydomain-org-works-but-https-www-mydomain-org-doesnt/156706/15 "2021-07-30T20:24:31Z")
I succeeded in revoking the certificate. Then, I tried to ask for a new one but including www, it failed the very first time because I forgot to modify the virtual host for www, I retried to ask for a new certificate but it failed again with the error message "live directory exists for [commudaire.org](http://commudaire.org)", I deleted /etc/letsencrypt/live/commudaire.org and it helped me to get a new certificate but now, the files are stored into subdirectories named "commudaire.org-0001" instead of "[commudaire.org](http://commudaire.org)" which breaks my script. How can I get back to the previous behaviour without reinstalling everything from scratch? This is my change in my script, which works as expected: [https://sourceforge.net/p/red-feed-aggregator/code/ci/71ba210fb4554519790c5af872024cc1a32f658f/tree/minimal\_self\_hosting\_setup.sh?diff=24d0a50486be2367e136b3f65fa85613d9cc9425](https://sourceforge.net/p/red-feed-aggregator/code/ci/71ba210fb4554519790c5af872024cc1a32f658f/tree/minimal_self_hosting_setup.sh?diff=24d0a50486be2367e136b3f65fa85613d9cc9425) This is the whole script: [https://sourceforge.net/p/red-feed-aggregator/code/ci/master/tree/minimal\_self\_hosting\_setup.sh](https://sourceforge.net/p/red-feed-aggregator/code/ci/master/tree/minimal_self_hosting_setup.sh) I'd prefer avoiding to have to "guess" the subdirectory names. There are some options to force which subdirectories to use but might it break certbot in my case? I expected it would use [commudaire.org](http://commudaire.org) instead of commudaire.org-0001. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [July 30, 2021, 8:28pm UTC](https://community.letsencrypt.org/t/https-mydomain-org-works-but-https-www-mydomain-org-doesnt/156706/16 "2021-07-30T20:28:57Z")
> [@gouessej](#): > > revoke Why revoke? Revoking wastes LE resources and should only be used when there has been a compromised private key. You should probably have used: `certbot delete` > [@gouessej](#): > > I deleted /etc/letsencrypt/live/commudaire.org Manually? Please don't delete files or folder within the `/etc/letsencrypt/` path. There are plenty of commands to instruct certbot` to do whatever you need. > [@gouessej](#): > > the files are stored into subdirectories named "commudaire.org-0001" instead of "[commudaire.org](http://commudaire.org)" Again, you should NOT have tried to "fix" this manually. > [@gouessej](#): > > How can I get back to the previous behaviour without reinstalling everything from scratch? You would need to `certbot delete` any certificates that you don't need. Then recreate a new cert with both domain names on it and pass it the `--cert-name commudaire.org` to put the new cert in the path you need. ---
**Author:** ![gouessej](https://avatars.discourse-cdn.com/v4/letter/g/a6a055/32.png) [@gouessej](https://community.letsencrypt.org/u/gouessej)\ **Post date:** [July 30, 2021, 8:34pm UTC](https://community.letsencrypt.org/t/https-mydomain-org-works-but-https-www-mydomain-org-doesnt/156706/17 "2021-07-30T20:34:33Z")
Yes I deleted it manually, I did a mistake. When I revoked the certificate with certbot revoke, it asked me whether I wanted to delete it too, I answered yes but when I asked for a new certificate, I got the error message about "live". Ok, I'm going to use certbot delete right now and then I'll force the certificate name. Thank you so much for your valuable help. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [July 30, 2021, 8:40pm UTC](https://community.letsencrypt.org/t/https-mydomain-org-works-but-https-www-mydomain-org-doesnt/156706/18 "2021-07-30T20:40:07Z")
Before getting the new cert. And after deleting those you don't need. Check the output of: `certbot certificates` and make sure the cert-name you want to use isn't still being used. If so, then you should also delete that one too. ---
**Author:** ![gouessej](https://avatars.discourse-cdn.com/v4/letter/g/a6a055/32.png) [@gouessej](https://community.letsencrypt.org/u/gouessej)\ **Post date:** [July 30, 2021, 8:55pm UTC](https://community.letsencrypt.org/t/https-mydomain-org-works-but-https-www-mydomain-org-doesnt/156706/19 "2021-07-30T20:55:15Z")
Yes, I asked certbot to delete the old certificate named "[commudaire.org](http://commudaire.org)" too, it deleted both "[commudaire.org](http://commudaire.org)" and "commudaire.org-0001" despite displaying the error message "An unexpected error occurred: TypeError: remove: path should be string, bytes or os.PathLike, not NoneType" It works like a charm now, thank you. To sum up a bit, I had to get rid of the web redirection because I can't obviously generate a certificate for my registrar, I had to get rid of the parking page of my registrar but without using its web redirection by removing its CNAME record in my DNS zone file, I had to add my own A record for the subdomain named "www" to replace its parking page, I had to delete my certificate covering only my domain name but not including "www" and finally, I had to modify my virtual host for "www" and I asked for a new certificate including my domain name with and without www. By the way, your suggestions were extremely helpful and drove my script more robust 🙂 Thanks again. Let's Encrypt rocks. ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [July 30, 2021, 10:12pm UTC](https://community.letsencrypt.org/t/https-mydomain-org-works-but-https-www-mydomain-org-doesnt/156706/20 "2021-07-30T22:12:14Z")
If you don't mind, I'd like to do you the favor of making sure there are no boggarts in your configuration: What are the outputs of: ```nohighlight sudo ls -lRa /etc/letsencrypt sudo certbot certificates ``` Please put 3 backticks above and below _each_ output, like this: ``` output ``` [Next page](https://community.letsencrypt.org/t/https-mydomain-org-works-but-https-www-mydomain-org-doesnt/156706.md?page=2)