<div id="readability-page-1" class="page"><div>
        
      
      <blockquote>
  <p>Case of subdomain’s certificate was applied to root domain.</p>
</blockquote>



<h2 id="environment-and-prerequisite">Environment and Prerequisite</h2>

<ul>
  <li>Let’s Encrypt</li>
  <li>Nginx</li>
  <li>Certbot</li>
</ul>



<h2 id="background">Background</h2>

<ul>
  <li>Due to my Curiosity, I searched my domain certificate and found that domain’s certificate was configured to subdomain’s certificate so I modified it. For example, if domain is <code>twpower.org</code>, the certificate was displayed as <code>subdomain.twpower.org</code>’s certificate in browser.</li>
  <li>Running server is <strong>Nginx</strong> environment and set certificate by using <strong>certbot</strong>.</li>
</ul>



<h2 id="reason">Reason</h2>

<ul>
  <li>I used a <strong>Let’s Encrypt</strong> certificate and set it up using <strong>certbot</strong>. I found that I needed to set certificate per doamin. However I set up domain and subdomain simultaneously.</li>
  <li><a href="https://www.digitalocean.com/community/tutorials/how-to-create-let-s-encrypt-wildcard-certificates-with-certbot">Link</a> shows a way of applying wildcard which contain subdomain. However I did not follow that way because it looks not easy.</li>
</ul>



<h2 id="fix-method">Fix Method</h2>

<ul>
  <li>Certificate setting should be applied per domain. For example if there are domain <code>twpower.org</code> and subdomain <code>subdomain.twpower.org</code> then it can be applied like below command.</li>
  <li>It is possible to apply to subdomain using above <a href="https://www.digitalocean.com/community/tutorials/how-to-create-let-s-encrypt-wildcard-certificates-with-certbot">Link</a>. However this post does not include that method.</li>
</ul>

<div><pre><code>sudo certbot --nginx -d twpower.org -d www.twpower.org
sudo certbot --nginx -d subdomain.twpower.org
</code></pre></div>



<h2 id="fix-process">Fix Process</h2>

<p>Remove exist previous setting by <strong>certbot</strong> and set certificate again.</p>



<h3 id="remove-existing-configurations-created-by-certbot">Remove existing configurations created by certbot</h3>

<p>There are setting files per domain in <code>/etc/nginx/sites-enabled/</code>.</p>

<div><pre><code>twpower@twpower-private-server:/etc/nginx/sites-enabled$ ls /etc/nginx/sites-enabled/
subdomain.twpower.org  twpower.org
</code></pre></div>

<p>The parts configured by <strong>certbot</strong> are commented as shown below.</p>

<div><pre><code>if ($host = www.twpower.org) {
    return 301 https://$host$request_uri;
} # managed by Certbot


if ($host = twpower.org) {
    return 301 https://$host$request_uri;
} # managed by Certbot
</code></pre></div>

<p>To remove previous exist setting, I removed codes which commented with <code># managed by Certbot</code>.</p>

<h3 id="check-nginx">Check Nginx</h3>



<h3 id="set-certificate-using-certbot">Set Certificate Using certbot</h3>

<p>If nginx configuration is correct, refer to the command below to apply the certificate to both domain and subdomain.</p>

<div><pre><code>sudo certbot --nginx -d twpower.org -d www.twpower.org
sudo certbot --nginx -d subdomain.twpower.org
</code></pre></div>



<h2 id="result">Result</h2>

<ul>
  <li>Each domain has each own certificate.</li>
</ul>



<h2 id="opinion">Opinion</h2>

<ul>
  <li>These days, cloud services handle these tasks, so I may not encounter this situation again.</li>
  <li>Not only do cloud services handle this, but we also live in an era where services like ChatGPT provide detailed instructions, so I might not have the chance to encounter this again.</li>
  <li>When running a small server like me, this could be helpful.</li>
</ul>



<h2 id="reference">Reference</h2>

<ul>
  <li><a href="https://certbot.eff.org/instructions?ws=nginx&amp;os=debianbuster">https://certbot.eff.org/instructions?ws=nginx&amp;os=debianbuster</a></li>
  <li><a href="https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-20-04">https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-20-04</a></li>
  <li><a href="https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-22-04">https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-22-04</a></li>
</ul>

      
        
        
        </div></div>

TWpower’s Tech Blog

Case of subdomain’s certificate was applied to root domain.
Environment and Prerequisite
Let’s Encrypt
Nginx
Certbot
Background
Due to my Curiosity, I searched my domain certificate and found that domain’s certificate was configured to subdomain’s certificate so I modified it. For example, if domain is twpower.org, the certificate was displayed as subdomain.twpower.org’s certificate in browser.
Running server is Nginx environment and set certificate by using certbot.
Reason
I used a Let’s Encrypt certificate and set it up using certbot. I found that I needed to set certificate per doamin. However I set up domain and subdomain simultaneously.
Link shows a way of applying wildcard which contain subdomain. However I did not follow that way because it looks not easy.
Fix Method
Certificate setting should be applied per domain. For example if there are domain twpower.org and subdomain subdomain.twpower.org then it can be applied like below command.
It is possible to apply to subdomain using above Link. However this post does not include that method.
sudo certbot --nginx -d twpower.org -d www.twpower.org
sudo certbot --nginx -d subdomain.twpower.org
Fix Process
Remove exist previous setting by certbot and set certificate again.
Remove existing configurations created by certbot
There are setting files per domain in /etc/nginx/sites-enabled/.
twpower@twpower-private-server:/etc/nginx/sites-enabled$ ls /etc/nginx/sites-enabled/
subdomain.twpower.org  twpower.org
The parts configured by certbot are commented as shown below.
if ($host = www.twpower.org) {
    return 301 https://$host$request_uri;
} # managed by Certbot
if ($host = twpower.org) {
    return 301 https://$host$request_uri;
} # managed by Certbot
To remove previous exist setting, I removed codes which commented with # managed by Certbot.
Check Nginx
sudo nginx -t
Set Certificate Using certbot
If nginx configuration is correct, refer to the command below to apply the certificate to both domain and subdomain.
sudo certbot --nginx -d twpower.org -d www.twpower.org
sudo certbot --nginx -d subdomain.twpower.org
Result
Each domain has each own certificate.
Opinion
These days, cloud services handle these tasks, so I may not encounter this situation again.
Not only do cloud services handle this, but we also live in an era where services like ChatGPT provide detailed instructions, so I might not have the chance to encounter this again.
When running a small server like me, this could be helpful.
Reference
https://certbot.eff.org/instructions?ws=nginx&os=debianbuster
https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-20-04
https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-22-04

[Let’s Encrypt](EN) Case of subdomain’s certificate was applied to root domain

댓글