Multiple domains, same website, only 1 subdomain is "not secure"

My domain is: felipeathayde.com.br

I've added multiple domains to be secured: felipeathayde.com.br and drfelipeathayde.com.br - both with and without www

felipeathayde.com.br, www.felipeathaye.com.br, www.drfelipeathayde.com.br are all secure but drfelipeathayde.com.br is not secure for some reason.

Apache, Debian 10 - I can login to a root shell on my machine - certbot 1.27.0

My main domain is felipeathayde.com.br, its A record is set to https://34.151.204.57/, which is the static IP of my website, I've added a CNAME to www.felipeathayde.com.br point to felipeathayde.com.br.

My second domain is drfelipeathayde.com.br, its A record is also set to https://34.151.204.57/, and I've added a CNAME to make www.drfelipeathayde.com.br point to felipeathayde.com.br. For some reason, I think my A record might be the problem, since I get a secure page when using www before drfelipe~

Thanks in advance.

1 Like

I see https://drfelipeathayde.com.br as secure. See this SSL test site or even try SSL Labs. One problem is that http://drfelipeathayde.com.br does not redirect to https.

Although, the www of that also does not redirect so I can't explain why that works differently for you.

If you try https:// explicitly, do those work right for you?

3 Likes

Both http://drfelipeathayde.com.br/ as wel as http://www.drfelipeathayde.com.br/ don't have a HTTP to HTTPS redirect set. This in contrast to your (www.)felipeathaye.com.br hostnames.

By the way, same goes for your .com TLDs (i.e., without .br). Oh and for your http://felipeathayde.com and http://www.felipeathayde.com hostnames!

So in effect, only felipeathayde.com.br and www.felipeathayde.com.br are redirecting correctly.

4 Likes

I own felipeathayde.com.br, felipeathayde.com, drfelipeathayde.com.br, and drfelipeathayde.com.

Indeed, explicitly using HTTPS always works. So this is the issue, thanks!

However, I find it intriguing how felipeathayde.com and felipeathayde.com.br both with and without www automatically redirect to HTTPS while both drfelipeathayde.com and drfelipeathayde.com.br WITHOUT www require HTTPS to be manually added.

It makes me wonder if "A record" will never add HTTPS to URLs unless done manually. However, felipeathayde.com does not need HTTPS to be added manually, despite being managed by the same DNS and drfelipeathayde.com, while both .BR domains are managed by another DNS.

1 Like

Nope:

osiris@erazer ~ $ curl -LIv http://felipeathayde.com
*   Trying 34.151.204.57:80...
* Connected to felipeathayde.com (34.151.204.57) port 80 (#0)
> HEAD / HTTP/1.1
> Host: felipeathayde.com
> User-Agent: curl/7.79.1
> Accept: */*
> 
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
HTTP/1.1 200 OK
< Date: Sun, 22 May 2022 16:22:25 GMT
Date: Sun, 22 May 2022 16:22:25 GMT
< Server: Apache
Server: Apache
< Link: <https://felipeathayde.com.br/index.php?rest_route=/>; rel="https://api.w.org/"
Link: <https://felipeathayde.com.br/index.php?rest_route=/>; rel="https://api.w.org/"
< Content-Type: text/html; charset=UTF-8
Content-Type: text/html; charset=UTF-8

< 
* Connection #0 to host felipeathayde.com left intact
osiris@erazer ~ $ curl -LIv http://www.felipeathayde.com
*   Trying 34.151.204.57:80...
* Connected to www.felipeathayde.com (34.151.204.57) port 80 (#0)
> HEAD / HTTP/1.1
> Host: www.felipeathayde.com
> User-Agent: curl/7.79.1
> Accept: */*
> 
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
HTTP/1.1 200 OK
< Date: Sun, 22 May 2022 16:22:34 GMT
Date: Sun, 22 May 2022 16:22:34 GMT
< Server: Apache
Server: Apache
< Link: <https://felipeathayde.com.br/index.php?rest_route=/>; rel="https://api.w.org/"
Link: <https://felipeathayde.com.br/index.php?rest_route=/>; rel="https://api.w.org/"
< Content-Type: text/html; charset=UTF-8
Content-Type: text/html; charset=UTF-8

< 
* Connection #0 to host www.felipeathayde.com left intact
osiris@erazer ~ $ 

No redirects for felipeathayde.com nor the www subdomain.

These redirects we're mentioning are redirects in the HTTP layer using a HTTP Location header. Not DNS. A HTTP client like a webbrowser (or curl) can't be bothered with DNS CNAMEs and/or A resource records. That's a different layer entirely.

3 Likes

Since you are working with Apache, I wonder what might be shown with:
apachectl -t -D DUMP_VHOSTS

2 Likes

To be honest, I don't know how to do it through Google Cloud console. Using the command you've provided didn't work, I guess I have to access Apache (?) prior do doing that? Couldn't find the answer for that also. Any chance you can help me on that?

I'm also considering editing .htaccess to redirect all traffic to https, but I'm sure if that is a good approach considering best practices on security and stuff.

1 Like

Do you have SSH (PuTTY) access?

2 Likes

Yes, I do. How should I proceed?

1 Like

SSH to the server and execute:
apachectl -t -D DUMP_VHOSTS
OR [it might require sudo]
sudo apachectl -t -D DUMP_VHOSTS

2 Likes

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.