Hello,
I use Ubuntu 18.04 with Nginx, i would like to configure a wildcard certificate because i want to use several subdomains.
I already have make some tests, i read a lot of documentation before arriving here…
I can generate my wildcard certificate like this:
certbot certonly --agree-tos --email contact@exemple.com --server https://acme-v02.api.letsencrypt.org/directory --manual -d *.exemple.com exemple.com
It works :
Before continuing, verify the record is deployed.
-------------------------------------------------------------------------------
Press Enter to Continue
Waiting for verification...
Cleaning up challenges
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/exemple.com/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/exemple.com/privkey.pem
Your cert will expire on 2019-03-02. To obtain a new or tweaked
version of this certificate in the future, simply run certbot
again. To non-interactively renew *all* of your certificates, run
"certbot renew"
- If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le
I also used various methods to generate the key and almost all have succeeded.
But, this does not work on the site, only “example.com” and “www.example.com” are supported by the SSL certificate despite several restart of the Nginx server.
I wonder if it can come from the server?
Here is the vhost:
server {
listen 80;
listen [::]:80;
server_name *.exemple.com exemple.com;
include /var/www/snippets/letsencrypt.conf;
#Force SSL
#return 301 https://$host$request_uri;
root /var/www/html/;
index index.php;
error_log /var/log/nginx/local_error.log;
access_log /var/log/nginx/local_access.log;
client_max_body_size 100M;
location / {
try_files $uri $uri/ /index.php?$args;
}
location ~ \.php$ {
fastcgi_pass php:9000;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
fastcgi_param DOCUMENT_ROOT $realpath_root;
}
}
server {
listen 443 ssl http2;
server_name *.exemple.com exemple.com;
root /var/www/html/;
index index.php;
ssl_certificate /etc/letsencrypt/live/exemple.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/exemple.com/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/exemple.com/chain.pem;
include /var/www/snippets/ssl.conf;
include /var/www/snippets/letsencrypt.conf;
error_log /var/log/nginx/local_error.log;
access_log /var/log/nginx/local_access.log;
location / {
try_files $uri $uri/ /index.php?$args;
}
location ~ \.php$ {
fastcgi_pass php:9000;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
fastcgi_param DOCUMENT_ROOT $realpath_root;
}
}
Here is the SSL configuration:
ssl_dhparam /var/www/snippets/certs/dhparam.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
ssl_prefer_server_ciphers on;
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 30s;
add_header Strict-Transport-Security "max-age=15768000; includeSubdomains; preload";
add_header X-Frame-Options SAMEORIGIN;
add_header X-Content-Type-Options nosniff;
I do not have any errors in the logs, the certificates seem correct, but i am restricted to “example.com” and “www.example.com”…
For the curious, you can try the site here: https://www.devosi.pro/index.html (I will remove the link once the subject resolves)
Thank you for your help !
