Everything worked out, but I'm confused.
Is this procedure correct?
I have 1x public domain
example.com
I renew the certificate as follows
sudo certbot --nginx
I created a private subdomain on apache2
sudo mkdir /var/www/html/www.example.com/subdomain
sudo nano /etc/apache2/sites-available/subdomain.example.com.conf
<VirtualHost *:80>
ServerAdmin admin@subdomain.example.com
ServerName subdomain.example.com
DocumentRoot /var/www/html/www.example.com/subdomain/
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>
sudo chown www-data:www-data -R /var/www/html/www.example.com/subdomain
sudo a2ensite subdomain.example.com.conf
sudo systemctl reload apache2
I created a server block in the reverse proxy nginx for the subdomain.
sudo nano /etc/nginx/sites-available/subdomain.example.com
server {
listen 80;
server_name subdomain.example.com;
location / {
proxy_pass http://192.168.1.106;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
sudo nginx -t
sudo ln -s /etc/nginx/sites-available/subdomain.example.com /etc/nginx/sites-enabled/subdomain.example.com
sudo systemctl reload nginx
On pfsense, I configured a host override for the subdomain. Everything works great, of course without LE cert. The subdomain only needs to work on the LAN.
Now I'm going to generate a certificate for no public domain (resp. wildcard).
sudo certbot -d *.example.com --manual --preferred-challenges dns certonly
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator manual, Installer None
Obtaining a new certificate
Performing the following challenges:
dns-01 challenge for example.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NOTE: The IP of this machine will be publicly logged as having requested this
certificate. If you're running certbot in manual mode on a machine that is not
your server, please ensure you're okay with that.
Are you OK with your IP being logged?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: y
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please deploy a DNS TXT record under the name
_acme-challenge.example.com with the following value:
X7RMZ1ompP_xXGWWPPT8TVUQ8fvGPAg-PkaxsadZFIo
Before continuing, verify the record is deployed.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter to Continue
Waiting for verification...
Cleaning up challenges
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/example.com-0001/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/example.com-0001/privkey.pem
Your cert will expire on 2022-04-03. To obtain a new or tweaked
version of this certificate in the future, simply run certbot
again. To non-interactively renew *all* of your certificates, run
"certbot renew"
- If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le
I manually modified the configuration for the server block.
server {
server_name subdomain.example.com;
location / {
proxy_pass http://192.168.1.106;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/example.com-0001/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com-0001/privkey.pem;
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
server {
if ($host = subdomain.example.com) {
return 301 https://$host$request_uri;
} # managed by Certbot
listen 80;
server_name subdomain.example.com;
return 404; # managed by Certbot
}
sudo systemctl reload nginx
If I enter the url into the browser subdomain.example.com everything works great. Private subdomain works with LE certificate.
I want to create another subdomain and I'm starting to get confused here.
I created another host override (subdomain2) on pfsense.
I created another vhost on apache2
sudo mkdir /var/www/html/www.example.com/subdomain2
sudo nano /etc/apache2/sites-available/subdomain2.example.com.conf
<VirtualHost *:80>
ServerAdmin admin@subdomain2.example.com
ServerName subdomain2.example.com
DocumentRoot /var/www/html/www.example.com/subdomain2/
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>
sudo chown www-data:www-data -R /var/www/html/www.example.com/subdomain2
sudo a2ensite subdomain2.example.com.conf
sudo systemctl reload apache2
If I enter the url subdomain2.example.com into the browser, it also works.
I don't understand how this can work when it doesn't already exist in the reverse proxy server block for this subdomain.
I don't think it should work.
