0

I'm using nginx to proxy a site internal to our firewall. Right now the following urls work:
    http://sitename (-> https://sitename.example.com)
    http://sitename.example.com (-> https://sitename.example.com)
    https://sitename.example.com

But https://sitename fails (error below) and I'd like it to work. Is this possible? If so, how?

The nginx.conf file looks like:

server {
    listen 80;
    server_name sitename.example.com;
    return 301 https://sitename.example.com$request_uri;
}
server {
    listen 443 ssl;
    server_name sitename.example.com;
    ssl_certificate /etc/letsencrypt/live/sitename.example.com/fullchain.pem;
    ...
    location / {
        proxy_pass http://foo.example.com:3000;
    }
}

I've tried inserting sections like this into nginx.conf:

server {
    listen 443 ssl;
    server_name sitename;
    return 301 https://sitename.example.com$request_uri;
}

or:

server {
    listen 443 ssl;
    server_name sitename;
    ssl_certificate /etc/letsencrypt/live/sitename.example.com/fullchain.pem;
    ...
    location / {
        proxy_pass http://foo.example.com:3000;
    }
}

Any of the combinations I've tried results in the same error:

$ curl -vL https://sitename
*   Trying 10.0.0.2:443...
* Connected to sitename (10.0.0.2) port 443 (#0)
    ...
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: CN=sitename.example.com
*  start date: May  5 23:18:34 2021 GMT
*  expire date: Aug  3 23:18:34 2021 GMT
*  subjectAltName does not match sitename
* SSL: no alternative certificate subject name matches target host name 'sitename'
* Closing connection 0
* TLSv1.2 (OUT), TLS alert, close notify (256):

$ echo $?
60
6
  • The certificate provided by server to client when connecting does not have a name matching the name in the URL. So you need to provide the correct certificate to client. – Patrick Mevzek May 6 at 17:15
  • yes, i understand how/why it's failing in its current config. i'm trying to figure out if there's a work-around. i don't want to get two certs for each sitename: "sitename" and a "sitename.example.com". – keithpjolley May 7 at 15:18
  • certificates should always use absolute hostnames for obvious reasons. Which will be the case if you get them from public CAs. if you generate them yourself for local tests, there is no problem in having whatever names you want in the SAN extension, no need for multiple certificates. – Patrick Mevzek May 7 at 15:57
  • i understand how/why it's failing. i'm hoping that i can proxy hostname to hostname.example.com – keithpjolley May 7 at 22:10
  • Not at the HTTPS level, as the TLS handshake (hence certificate exchange and validation) will happen before the HTTP level and any proxying/redirecting that can happens there. – Patrick Mevzek May 7 at 23:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.