SSL is not valid for www.domain.com

[good_guy (good)]

My SSL is not valid for www.domain.com but it is with domain.com

How would I make it secure with www? I have the free SSL you get upon self hosting discourse

[Jagster (Jakke Lehtonen)]

You can’t.

Lets Encrypt is free too, so

[good_guy (good)]

Yeah I know it’s free, but what’s a method to encrypt www?

Since I have it to direct to domain.com but it pops up with “this site is not secure” when going through www

[Jagster (Jakke Lehtonen)]

Because it is created only for apex, or you are referring it wrong where ever you are trying to terminate it.

@good_guy

I have the free SSL you get upon self hosting discourse

Discourse creates SSL when installed. And it’s by Lets Encrypt. So perhaps you should ask from what ever company now gave it to you.

I don’t totally understand why to bother.

[good_guy (good)]

Because when you visit www.mysite.com, it prompts with “This site is unsecure, do you wish to continue” type of message, then it redirects to the SSL version (https). I’ll ask Lets Encrypt on any solutions.

[Jagster (Jakke Lehtonen)]

You have to create it for www too.

If you create it by manually you have to use something like certbot certonly --nginx -d domain.com -d www.domain.com. Basically every sub-domain needs its own.

I don’t know how it is now, but wildcard certificate (same for apex and every subdomains) didn’t work too well when created using Lets Encrypt.

But again. You don’t need to worry that, because Discourse does it for you — except if your DNS settings are wrong or some other reason when your forum is unreachable.

[good_guy (good)]

Sorry I don’t exactly understand, DNS works fine I guess, its just a URL redirect.

www → https://domain.com
this part says

www.domain.com doesn't support a secure connection
You are seeing this warning because this site does not support HTTPS 

But when using domain.com its fine.

Should I try certbot certonly --nginx -d domain.com -d www.domain.com?

[Jagster (Jakke Lehtonen)]

I don’t know what you should try, Idon’t even know what you are trying to do, how and where.

All I try to say is:

• you need different certificates for apex and www, or your sites in web server are configurated wrong
• you don’t need to do anything because Discourse creates SSL certificate for you when setting up a forum

[merefield (Robert)]

There’s a topic on this:

Set up Let’s Encrypt with multiple domains / redirects

This is to address the problem where you get certificate errors with any redirects or CNAME DNS entries which point to your actual installed Discourse (sub)domain. If you do not have https configured already (you do if you have done a standard install recently) see Setting up Let’s Encrypt as your first step. There are two patterns that need to be replaced, one ending in --keylength, and another ending in --fullchainpath (in the actual file, your original domain is before each of these switche…

[good_guy (good)]

Thank you.

after_ssl:
   # tell letsencrypt what additional certs to get
    - replace:
        filename: "/etc/runit/1.d/letsencrypt"
        from: /--keylength/
        to: "-d site.com -d www.mysite.com --keylength"
    - replace:
        filename: "/etc/runit/1.d/letsencrypt"
        from: /--fullchainpath/
        to: "-d site.com -d www.mysite.com --fullchainpath"

So this should make the www go to mysite.com? Or is it the opposite way around?

[Jagster (Jakke Lehtonen)]

No. It gives to you two certificates. One for apex, one for www.

[pfaffman (Jay Pfaffman)]

If your hostname is site.com then you have it right. And that seems to be the case.

It’s generally recommended that your site be at www.site.com and have the apex domain redirect to the www. What I would do is change your hostname to www.site.com and do it the other way around.

@Jagster

It gives to you two certificates. One for apex, one for www.

I think that it gives one certificate that is valid for both.