# SSL is not valid for www.domain.com
**URL:** https://meta.discourse.org/t/ssl-is-not-valid-for-www-domain-com/346525
**Category:** Self-hosting
**Created:** [January 10, 2025, 3:48pm UTC](https://meta.discourse.org/t/ssl-is-not-valid-for-www-domain-com/346525 "2025-01-10T15:48:17Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@good\_guy](https://meta.discourse.org/u/good_guy)
#### Post date: [January 10, 2025, 3:48pm UTC](https://meta.discourse.org/t/ssl-is-not-valid-for-www-domain-com/346525/1 "2025-01-10T15:48:17Z")
My SSL is not valid for [www.domain.com](http://www.domain.com) but it is with [domain.com](http://domain.com)
How would I make it secure with www? I have the free SSL you get upon self hosting discourse
---
### Author:  [@Jagster](https://meta.discourse.org/u/Jagster)
#### Post date: [January 10, 2025, 3:59pm UTC](https://meta.discourse.org/t/ssl-is-not-valid-for-www-domain-com/346525/2 "2025-01-10T15:59:17Z")
You can’t.
Lets Encrypt is free too, so 🤷‍♂️
---
### Author:  [@good\_guy](https://meta.discourse.org/u/good_guy)
#### Post date: [January 10, 2025, 4:10pm UTC](https://meta.discourse.org/t/ssl-is-not-valid-for-www-domain-com/346525/3 "2025-01-10T16:10:07Z")
Yeah I know it’s free, but what’s a method to encrypt www?
Since I have it to direct to [domain.com](http://domain.com) but it pops up with “this site is not secure” when going through www
---
### Author:  [@Jagster](https://meta.discourse.org/u/Jagster)
#### Post date: [January 10, 2025, 5:06pm UTC](https://meta.discourse.org/t/ssl-is-not-valid-for-www-domain-com/346525/4 "2025-01-10T17:06:51Z")
Because it is created only for apex, or you are referring it wrong where ever you are trying to terminate it.
> [@good\_guy](#):
>
> I have the free SSL you get upon self hosting discourse
Discourse creates SSL when installed. And it’s by Lets Encrypt. So perhaps you should ask from what ever company now gave it to you.
I don’t totally understand why to bother.
---
### Author:  [@good\_guy](https://meta.discourse.org/u/good_guy)
#### Post date: [January 10, 2025, 5:20pm UTC](https://meta.discourse.org/t/ssl-is-not-valid-for-www-domain-com/346525/5 "2025-01-10T17:20:27Z")
Because when you visit [www.mysite.com](http://www.mysite.com), it prompts with “This site is unsecure, do you wish to continue” type of message, then it redirects to the SSL version (https). I’ll ask Lets Encrypt on any solutions.
---
### Author:  [@Jagster](https://meta.discourse.org/u/Jagster)
#### Post date: [January 10, 2025, 5:28pm UTC](https://meta.discourse.org/t/ssl-is-not-valid-for-www-domain-com/346525/6 "2025-01-10T17:28:16Z")
You have to create it for www too.
If you create it by manually you have to use something like `certbot certonly --nginx -d domain.com -d www.domain.com`. Basically every sub-domain needs its own.
I don’t know how it is now, but wildcard certificate (same for apex and every subdomains) didn’t work too well when created using Lets Encrypt.
But again. You don’t need to worry that, because Discourse does it for you — except if your DNS settings are wrong or some other reason when your forum is unreachable.
---
### Author:  [@good\_guy](https://meta.discourse.org/u/good_guy)
#### Post date: [January 10, 2025, 5:32pm UTC](https://meta.discourse.org/t/ssl-is-not-valid-for-www-domain-com/346525/7 "2025-01-10T17:32:39Z")
Sorry I don’t exactly understand, DNS works fine I guess, its just a URL redirect.
**www → [https://domain.com](https://domain.com)**
this part says
```plaintext
www.domain.com doesn't support a secure connection
You are seeing this warning because this site does not support HTTPS
```
But when using [domain.com](http://domain.com) its fine.
Should I try `certbot certonly --nginx -d domain.com -d www.domain.com`?
---
### Author:  [@Jagster](https://meta.discourse.org/u/Jagster)
#### Post date: [January 10, 2025, 5:39pm UTC](https://meta.discourse.org/t/ssl-is-not-valid-for-www-domain-com/346525/8 "2025-01-10T17:39:03Z")
I don’t know what you should try, Idon’t even know what you are trying to do, how and where.
All I try to say is:
- you need different certificates for apex and www, or your sites in web server are configurated wrong
- you don’t need to do anything because Discourse creates SSL certificate for you when setting up a forum
---
### Author:  [@merefield](https://meta.discourse.org/u/merefield)
#### Post date: [January 10, 2025, 5:44pm UTC](https://meta.discourse.org/t/ssl-is-not-valid-for-www-domain-com/346525/9 "2025-01-10T17:44:30Z")
There’s a topic on this:
> [@Set up Let’s Encrypt with multiple domains / redirects](https://meta.discourse.org/t/set-up-let-s-encrypt-with-multiple-domains-redirects/56685):
>
> NOTE: @pfaffman says: This page needs to be cleaned up. There is now a new ENV setting that will let you add more hostnames. In your app.yml under your DISCOURSE\_HOSTNAME line (it can go many places but that one makes sense), add DISCOURSE\_HOSTNAME\_ALIASES: domain.com,other.domain.com and early reports suggest that you’ll get valid certs for those domains and that accessing https://domain.com will properly redirect you to your DISCOURSE\_HOSTNAME without a certificate error. If you do that an…
---
### Author:  [@good\_guy](https://meta.discourse.org/u/good_guy)
#### Post date: [January 10, 2025, 5:59pm UTC](https://meta.discourse.org/t/ssl-is-not-valid-for-www-domain-com/346525/10 "2025-01-10T17:59:44Z")
Thank you.
```plaintext
after_ssl:
# tell letsencrypt what additional certs to get
- replace:
filename: "/etc/runit/1.d/letsencrypt"
from: /--keylength/
to: "-d site.com -d www.mysite.com --keylength"
- replace:
filename: "/etc/runit/1.d/letsencrypt"
from: /--fullchainpath/
to: "-d site.com -d www.mysite.com --fullchainpath"
```
So this should make the www go to [mysite.com](http://mysite.com)? Or is it the opposite way around?
---
### Author:  [@Jagster](https://meta.discourse.org/u/Jagster)
#### Post date: [January 10, 2025, 7:00pm UTC](https://meta.discourse.org/t/ssl-is-not-valid-for-www-domain-com/346525/11 "2025-01-10T19:00:27Z")
No. It gives to you two certificates. One for apex, one for www.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [January 10, 2025, 8:05pm UTC](https://meta.discourse.org/t/ssl-is-not-valid-for-www-domain-com/346525/12 "2025-01-10T20:05:12Z")
If your hostname is `site.com` then you have it right. And that seems to be the case.
It’s generally recommended that your site be at `www.site.com` and have the apex domain redirect to the www. What I would do is change your hostname to `www.site.com` and do it the other way around.
> [@Jagster](#):
>
> It gives to you two certificates. One for apex, one for www.
I think that it gives one certificate that is valid for both.
---
### Author:  [@good\_guy](https://meta.discourse.org/u/good_guy)
#### Post date: [January 11, 2025, 7:19pm UTC](https://meta.discourse.org/t/ssl-is-not-valid-for-www-domain-com/346525/13 "2025-01-11T19:19:56Z")
Hello, I am bumping this because I thought I fixed it yesterday, but now when accessing **[www.mysite.com](http://www.mysite.com)** I am getting a non SSL redirection still.
The apex has a SSL, just not www.
Even though I applied this in my **app.yml** in **hooks** :
```plaintext
after_ssl:
# tell letsencrypt what additional certs to get
- replace:
filename: "/etc/runit/1.d/letsencrypt"
from: /--keylength/
to: "-d mysite.com -d www.mysite.com --keylength"
- replace:
filename: "/etc/runit/1.d/letsencrypt"
from: /--fullchainpath/
to: "-d mysite.com -d www.mysite.com --fullchainpath"
```
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [January 11, 2025, 7:26pm UTC](https://meta.discourse.org/t/ssl-is-not-valid-for-www-domain-com/346525/14 "2025-01-11T19:26:56Z")
Are you following the instructions at [Set up Let’s Encrypt with multiple domains / redirects](https://meta.discourse.org/t/set-up-let-s-encrypt-with-multiple-domains-redirects/56685)?
If you plug `www.mysite.com` in the tempate in the OP it generates this:
```plaintext
after_ssl:
# tell letsencrypt what additional certs to get
- replace:
filename: "/etc/runit/1.d/letsencrypt"
from: /--keylength/
to: "-d www.mysite.com --keylength"
- replace:
filename: "/etc/runit/1.d/letsencrypt"
from: /--fullchainpath/
to: "-d www.mysite.com --fullchainpath"
global: true
```
So you’re doing it wrong.
---
### Author:  [@good\_guy](https://meta.discourse.org/u/good_guy)
#### Post date: [January 11, 2025, 7:30pm UTC](https://meta.discourse.org/t/ssl-is-not-valid-for-www-domain-com/346525/15 "2025-01-11T19:30:48Z")
Ah, so that is not manually typed.
```plaintext
after_ssl:
# tell letsencrypt what additional certs to get
- replace:
filename: "/etc/runit/1.d/letsencrypt"
from: /--keylength/
to: "-d =domain2= --keylength"
- replace:
filename: "/etc/runit/1.d/letsencrypt"
from: /--fullchainpath/
to: "-d =domain2= --fullchainpath"
global: true
```
So do I have to do this and replace **domain2** with [mysite.com](http://mysite.com), then rebuild app?
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [January 11, 2025, 7:39pm UTC](https://meta.discourse.org/t/ssl-is-not-valid-for-www-domain-com/346525/16 "2025-01-11T19:39:05Z")
> [@good\_guy](#):
>
> Ah, so that is not manually typed.
If you enter your domain name in the field it will automatically fill in the `=domain2=` with the domain so you can copy/paste that block.
> [@good\_guy](#):
>
> So do I have to do this and replace **domain2** with [mysite.com](http://mysite.com), then rebuild app?
Yes.
---
### Author:  [@good\_guy](https://meta.discourse.org/u/good_guy)
#### Post date: [January 11, 2025, 8:27pm UTC](https://meta.discourse.org/t/ssl-is-not-valid-for-www-domain-com/346525/17 "2025-01-11T20:27:35Z")
Hey, just did this, unfortunately same result. This is what I did but with my domain instead.
No whitespaces, proper formatting.
```plaintext
after_ssl:
# tell letsencrypt what additional certs to get
- replace:
filename: "/etc/runit/1.d/letsencrypt"
from: /--keylength/
to: "-d =mysite.com= --keylength"
- replace:
filename: "/etc/runit/1.d/letsencrypt"
from: /--fullchainpath/
to: "-d =mysite.com= --fullchainpath"
global: true
```
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [January 11, 2025, 8:31pm UTC](https://meta.discourse.org/t/ssl-is-not-valid-for-www-domain-com/346525/18 "2025-01-11T20:31:14Z")
Since you haven’t solved this, I un-checked the solved box.
If you did a bunch of rebuilds with the other stanza then you might be rate limited.
There is a chance that the template has changed again and this no longer works, but I doubt it.
The solutions to rate limiting are to wait a week or to add a third subdomain.
You can get inside the container and run a command to request the URL and see what the error is, but I can’t remember what it is. You might be able to see an error if you look at
```
docker logs app
```
---
### Author:  [@good\_guy](https://meta.discourse.org/u/good_guy)
#### Post date: [January 11, 2025, 8:35pm UTC](https://meta.discourse.org/t/ssl-is-not-valid-for-www-domain-com/346525/19 "2025-01-11T20:35:28Z")
Ah I found it!
` Cannot issue for \"=mysite.com=\": Domain name contains an invalid character"`
So get rid of the = because those were for a variable?
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [January 11, 2025, 8:36pm UTC](https://meta.discourse.org/t/ssl-is-not-valid-for-www-domain-com/346525/20 "2025-01-11T20:36:12Z")
Did you use the form on the other page as I suggested and put your hostname in the blank?
[Next page](https://meta.discourse.org/t/ssl-is-not-valid-for-www-domain-com/346525.md?page=2)