# SSL working on root, but not on www
**URL:** https://meta.discourse.org/t/ssl-working-on-root-but-not-on-www/56647
**Category:** Support
**Created:** [January 31, 2017, 12:04pm UTC](https://meta.discourse.org/t/ssl-working-on-root-but-not-on-www/56647 "2017-01-31T12:04:33Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@RuxBux](https://meta.discourse.org/u/RuxBux)
#### Post date: [January 31, 2017, 12:04pm UTC](https://meta.discourse.org/t/ssl-working-on-root-but-not-on-www/56647/1 "2017-01-31T12:04:33Z")
Ive completed lentsencrypt setup and its working good…
but problem is, everything is ok until i try with www
msg is “this server is not secured”
how can i fix this?
---
### Author:  [@dionbeukes](https://meta.discourse.org/u/dionbeukes)
#### Post date: [January 31, 2017, 1:03pm UTC](https://meta.discourse.org/t/ssl-working-on-root-but-not-on-www/56647/2 "2017-01-31T13:03:16Z")
hi, when you created your certificate, did you list all your domains you have on there? When you create a certificate with letsencrypt you need to list all your domains and subdomains on there that you want the certificate to be valid for. for example, … [example.com](http://example.com) is regarded as the root domain, and www is regarded as a subdomain, therefore you need to list when you create the certificate [example.com](http://example.com), [www.example.com](http://www.example.com), [shop.example.com](http://shop.example.com) etc, I guess you did not set www.???.??? on your certificate when you created it, and so the certificate is invalid for the subdomain www.
---
### Author:  [@RuxBux](https://meta.discourse.org/u/RuxBux)
#### Post date: [January 31, 2017, 1:06pm UTC](https://meta.discourse.org/t/ssl-working-on-root-but-not-on-www/56647/3 "2017-01-31T13:06:35Z")
can i require new cert, this time adding and www?
when i go acme.sh i can see [example.com](http://example.com) and [www.example.com](http://www.example.com)
problem is, also when typing [www.example.com](http://www.example.com) i got redirected to [example.com](http://example.com)
i still didnt checked force ssl
---
### Author:  [@dionbeukes](https://meta.discourse.org/u/dionbeukes)
#### Post date: [January 31, 2017, 1:10pm UTC](https://meta.discourse.org/t/ssl-working-on-root-but-not-on-www/56647/4 "2017-01-31T13:10:39Z")
how do you host your discourse instance? how is your server set up?
---
### Author:  [@RuxBux](https://meta.discourse.org/u/RuxBux)
#### Post date: [January 31, 2017, 1:14pm UTC](https://meta.discourse.org/t/ssl-working-on-root-but-not-on-www/56647/5 "2017-01-31T13:14:49Z")
its on linux server that i bought @ [vultr.com](http://vultr.com) 🙂
its on docker
---
### Author:  [@dionbeukes](https://meta.discourse.org/u/dionbeukes)
#### Post date: [January 31, 2017, 1:20pm UTC](https://meta.discourse.org/t/ssl-working-on-root-but-not-on-www/56647/6 "2017-01-31T13:20:55Z")
I think it must have been when you setup your discourse in the beginning “Enter the hostname you’d like to use for Discourse” you might have selected the root of your domain in the setup and maybe thats why it throws you back to that everytime you put in www.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [January 31, 2017, 1:36pm UTC](https://meta.discourse.org/t/ssl-working-on-root-but-not-on-www/56647/7 "2017-01-31T13:36:11Z")
I don’t think that the letsemcrypt module supports multiple domain names, right @tgxworld?
---
### Author:  [@RuxBux](https://meta.discourse.org/u/RuxBux)
#### Post date: [January 31, 2017, 1:37pm UTC](https://meta.discourse.org/t/ssl-working-on-root-but-not-on-www/56647/8 "2017-01-31T13:37:09Z")
well for me im ok only with [www.example.com](http://www.example.com)
what should i do to fix this? change hostname of discourse??
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [January 31, 2017, 3:02pm UTC](https://meta.discourse.org/t/ssl-working-on-root-but-not-on-www/56647/9 "2017-01-31T15:02:26Z")
Right. Make the name in app.yml the name you want. It would arguably be good if you could passs let’s encrypt multiple host names, or pretend www by default, but most people run their forum on [forum.example.com](http://forum.example.com), so this doesn’t come up much.
You need to rebuild after you make the changes.
---
### Author:  [@RuxBux](https://meta.discourse.org/u/RuxBux)
#### Post date: [January 31, 2017, 3:05pm UTC](https://meta.discourse.org/t/ssl-working-on-root-but-not-on-www/56647/10 "2017-01-31T15:05:38Z")
now it makes sense why im having this problem…
but i dont want discourse on subdomain, main domain is what im aiming for 😃
yesterday i changed hostname in app.yml from [example.com](http://example.com) to [www.example.com](http://www.example.com)
but after rebuild, ssl was all mad on me, probably because ssl cert is pointing on [example.com](http://example.com) ?
then i returned in app.yml to [example.com](http://example.com) and now trying to figure out what to do 🙂
so, i should edit back to [www.example.com](http://www.example.com), then request new certificate… now thats the problem i dont know how to do it 🙂
im afraid im gonna broke what i have now …
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [January 31, 2017, 3:18pm UTC](https://meta.discourse.org/t/ssl-working-on-root-but-not-on-www/56647/11 "2017-01-31T15:18:24Z")
You know what to do. Now you understand that the certificate must match the host name you want to use.
---
### Author:  [@RuxBux](https://meta.discourse.org/u/RuxBux)
#### Post date: [January 31, 2017, 3:20pm UTC](https://meta.discourse.org/t/ssl-working-on-root-but-not-on-www/56647/12 "2017-01-31T15:20:03Z")
can you please, point me to the part of recert ?
i do it with acme.sh, what command 😃
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [January 31, 2017, 3:27pm UTC](https://meta.discourse.org/t/ssl-working-on-root-but-not-on-www/56647/13 "2017-01-31T15:27:15Z")
Edit: I thought that you were using the Discourse Let’s Encrypt module.
If you used acme.sh, then just use it again and enter both host names as suggested below.
---
### Author:  [@RuxBux](https://meta.discourse.org/u/RuxBux)
#### Post date: [January 31, 2017, 3:28pm UTC](https://meta.discourse.org/t/ssl-working-on-root-but-not-on-www/56647/14 "2017-01-31T15:28:28Z")
i did that, but when i tried to enter [www.example.com](http://www.example.com), i got, this server is not secure, procedure…
so next logical step is to reissue certificate and enter [www.example.com](http://www.example.com) instead of [example.com](http://example.com)
how do i do that?
root@crypto:/var/discourse# /var/discourse/shared/standalone/letsencrypt/acme.sh --cron --home “/var/discourse/shared/standalone/letsencrypt” [Mon Jan 30 23:20:32 UTC 2017] Renew: ‘[example.com](http://example.com)’
[Mon Jan 30 23:20:32 UTC 2017] Skip, Next renewal time is: Fri Mar 31 10:41:13 UTC 2017
[Mon Jan 30 23:20:32 UTC 2017] Add ‘–force’ to force to renew.
[Mon Jan 30 23:20:32 UTC 2017] Skipped [example.com](http://example.com)
[Mon Jan 30 23:20:32 UTC 2017] Renew: ‘[www.example.com](http://www.example.com)’
[Mon Jan 30 23:20:32 UTC 2017] Skip, Next renewal time is: Fri Mar 31 18:54:09 UTC 2017
[Mon Jan 30 23:20:32 UTC 2017] Add ‘–force’ to force to renew.
[Mon Jan 30 23:20:32 UTC 2017] Skipped [www.example.com](http://www.example.com)
from what i can see here, it skipped [www.example.com](http://www.example.com) ?
> **[Screenshot](https://prnt.sc/e2qs8e)**
>
> Captured with Lightshot
---
### Author:  [@dionbeukes](https://meta.discourse.org/u/dionbeukes)
#### Post date: [January 31, 2017, 5:25pm UTC](https://meta.discourse.org/t/ssl-working-on-root-but-not-on-www/56647/15 "2017-01-31T17:25:35Z")
do you have www in an A record on your dns? You must have a dns A record on your dns with www pointing to your ip address, some domain registrars/Zone records would automatically point www to your ip even if you don’t have www set as an A record, if that is the case it means there is a redirect, so if you put in your browser [www.exmaple.com](http://www.exmaple.com), your dns is redirecting it to you ip just on [example.com](http://example.com), and because your server listens on port 80 and 443, any requests coming in would be served whether it was on www or [example.com](http://example.com). Also from what I can see, with letsencrypt you need to do a new certificate issue and not a renew, with renew letsencrypt will check if the certificate you have is due for renewal if its not it will just exit and do nothing.
---
### Author:  [@RuxBux](https://meta.discourse.org/u/RuxBux)
#### Post date: [January 31, 2017, 11:05pm UTC](https://meta.discourse.org/t/ssl-working-on-root-but-not-on-www/56647/16 "2017-01-31T23:05:42Z")
Thanks for clearing that for me, @dionbeukes
tell me, should i totaly remove ssl from app.yml and rebuild to http… then start new procedure of SSL setup.
Or there is a recert command with acme.sh ?
---
### Author:  [@Nick\_Research](https://meta.discourse.org/u/Nick_Research)
#### Post date: [November 28, 2017, 5:26am UTC](https://meta.discourse.org/t/ssl-working-on-root-but-not-on-www/56647/17 "2017-11-28T05:26:29Z")
I’m following this thread and find that I have the same problem and the answers given here and elsewhere (after spending quite some time reading what’s on the forum) are really not clear to beginners like myself.
A quick description of my setup and the issue:
1. The discourse hostname (hosted on digital oceans) is [example.com](http://example.com)
2. It has LetsEncrypt and this works fine when going to [https://example.com](https://example.com)
3. On my DNS (which is hosted by dreamhost) I have an A record pointed to the digital oceans IP
4. On my DNS I also have a CNAME record for \* pointed to the same IP address
5. Until I read this post I also had DNS record for A with www pointed to the same IP address
I am having the same issue as the OP in that everything works perfectly for [https://example.com](https://example.com) and has a security warning for [https://www.example.com](https://www.example.com)
Is the comment from @dionbeukes saying that the problem is likely to be the A record with www causing problems?
I just want to clarify what is meant when you say “You must have a dns A record on your dns with www pointing to your ip address”.
Is that as in “you must do this” or as in “this must explain why you have a problem”?
Many thanks
---
### Author:  [@dionbeukes](https://meta.discourse.org/u/dionbeukes)
#### Post date: [November 28, 2017, 11:23am UTC](https://meta.discourse.org/t/ssl-working-on-root-but-not-on-www/56647/18 "2017-11-28T11:23:26Z")
Hi,
Thanks for your email, Ive not been on the forum for a while, I don’t know exactly what your problem or issue is. If you explain in detail what hapoens and what doesn’t and what you want to achieve I will reply with an answer explaining exactly what you should and shouldn’t do.
---
### Author:  [@dionbeukes](https://meta.discourse.org/u/dionbeukes)
#### Post date: [November 28, 2017, 11:36am UTC](https://meta.discourse.org/t/ssl-working-on-root-but-not-on-www/56647/19 "2017-11-28T11:36:48Z")
Hi,
Sorry, I read your post a few times. So your DNS is not the issue, because your subdomains and www all gets directed to the right ip address. The reason why you get a security warning for your www subdomain means the following. When a request gets directed to your server, depending on your settings, I presume you want all requests securely served. [https://example.com](https://example.com) works, but [https://www.example.com](https://www.example.com) gives a warning. You must list all your sub domains on letsencrypt. Either you must do a catch all meaning \*.[example.com](http://example.com) etc, I don’t do that to minimise the possibility of random subdomiains getting sexurely served instead I list all of the sub domains I want securely served. [www.example.com](http://www.example.com), [shop.example.com](http://shop.example.com) etc etc, reissue your letsencrypt certificate with all the right subdomains and your warning will go away. I’m not sure if letsencrypt does a catch all certificate, rather specify each subdomain you want to be served by the same certificate. Hope my explanation is clear enough,
Please email me again if you have more issues and your solution in the end.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [November 28, 2017, 2:07pm UTC](https://meta.discourse.org/t/ssl-working-on-root-but-not-on-www/56647/20 "2017-11-28T14:07:19Z")
Did you enable let’s encrypt in app.yml or did you run it yourself?
[Next page](https://meta.discourse.org/t/ssl-working-on-root-but-not-on-www/56647.md?page=2)