Subdomain issues

[cheonmu]

Please fill out the fields below so we can help you better.

My domain is: https://ururu.shop, https://cosme.ururu.shop, https://case.ururu.shop …

I ran this command:

It produced this output:

My operating system is (include version):

My web server is (include version):

ubuntu 16.04 + Nginx 1.9 + Php7.0-fpm + Mariadb 10

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don’t know):

YES

I’m using a control panel to manage my site (no, or provide the name and version of the control panel):

NO

Hi

Im using Letsencrypt certificate in several subdomains.

There is no problem with applying the certificate to domains on server, but some browsers (like Galaxy S and UCbrowser) says appears have not been trusted domain. (Chrome, Ios is ok)

I tried to test on https://www.ssllabs.com/, result is A+

I dont understand what is the problem.

Please let me know how to fix this problem.

[ahaw021]

do you know what the browsers on those phones are

trying using the legacy ciphers recommended by mozilla.

https://wiki.mozilla.org/Security/Server_Side_TLS

[MitchellK]

a solid working solution for LE and SSL on Nginx is a host .conf file like this, this includes all the correct ciphers as @ahaw021 mentioned and all ssl settings that Nginx needs.

server {
	# SSL configuration
	#
	listen 443 ssl http2;

	root /var/www/mywebsite.com;
	server_name mywebsite.com www.mywebsite.com;
	charset UTF-8;
	access_log /var/log/nginx/mywebsite.com-access.log;
	error_log /var/log/nginx/mywebsite.com-error.log;
	
	# First include our certificates and chain of trust
	ssl_certificate /etc/letsencrypt/live/mywebsite.com/fullchain.pem;
	ssl_certificate_key /etc/letsencrypt/live/mywebsite.com/privkey.pem;
	## verify chain of trust of OCSP response using Root CA and Intermediate certs
	ssl_trusted_certificate /etc/letsencrypt/live/mywebsite.com/chain.pem;

	# Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
	ssl_dhparam /etc/nginx/ssl/dhparam.pem;
	ssl_session_timeout 1d;
	ssl_session_cache shared:SSL:128m;
	ssl_session_tickets off;
	ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
	# ciphers recommended by https://mozilla.github.io/server-side-tls/ssl-config-generator/
	ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
	ssl_prefer_server_ciphers on;
	add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
	ssl_stapling on;
	ssl_stapling_verify on;

}
server {
	listen 80;
	server_name mywebsite.com www.mywebsite.com;
        return 301 https://mywebsite.com$request_uri;
# END OF HTTP PORT 80 HOST CONFIG - CLOSING BRACE BELOW THIS LINE
}