Mechanic needs a way to provide certificates for aliases

[matadur]

I am unable to get aliases to redirect on HTTPS sites.

If I set canonical=true, the site fails with a 502 Bad Gateway error.

If I set canonical=false, the site resolves, but to myalias.mysite.com instead of redirecting to www.mysite.com.

https://www.mysite.com loads fine

My certs are for root & wildcard (issued by CloudFlare).

I've verified [email protected] is installed on the server.

What else can I check/try?

[boutell]

What does the address bar say when you get the 502 bad gateway error? If it isn't redirecting you to https://www.mysite.com, then where is it leaving you?

…

On Sun, Apr 15, 2018 at 7:34 PM, matadur ***@***.***> wrote: I am unable to get aliases to redirect on HTTPS sites. If I set canonical=true, the site fails with a 502 Bad Gateway error. If I set canonical=false, the site resolves, but to myalias.mysite.com instead of redirecting to www.mysite.com. https://www.mysite.com loads fine My certs are for root & wildcard (issued by CloudFlare). I've verified ***@***.*** is installed on the server. What else can I check/try? — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#11>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAB9fZrnWYQGmAKPonO0Hxmx6Xy54mmOks5to9kXgaJpZM4TVstR> .

-- *THOMAS BOUTELL, CHIEF SOFTWARE ARCHITECT* P'UNK AVENUE | (215) 755-1330 | punkave.com

[matadur]

It's not redirecting in the browser; the URL bar still shows the alias, e.g. myalias.mysite.com.

I've tried multiple browsers and networks also.

Is there something I need to manually configure in nginx to get it to redirect the browser?

[boutell]

Hmmm. If you have certs for domains other than the main "host," mechanic is not currently looking for those and is not bundling references to them into its conf file. This is something we should work on. This is the first time we've had a case where it made sense to have secure certificates for the aliases as well as the main domain.

…

On Mon, Apr 16, 2018 at 3:37 PM, matadur ***@***.***> wrote: It's not redirecting in the browser; the URL bar still shows the alias, e.g. myalias.mysite.com. I've tried multiple browsers and networks also. Is there something I need to manually configure in nginx to get it to redirect the browser? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#11 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAB9fVUjvSY6cAn-hFMI8dcTtVKvfQTRks5tpPLjgaJpZM4TVstR> .

-- *THOMAS BOUTELL, CHIEF SOFTWARE ARCHITECT* P'UNK AVENUE | (215) 755-1330 | punkave.com

[matadur]

Okay so it's not something I can fix with my setup? The origin cert for the host is for root + wildcard, so I would think it should work for the aliases also. If it's not easily fixable, I can just perform the redirects at the DNS level for now. On Mon, Apr 16, 2018 at 1:41 PM, Tom Boutell <[email protected]> wrote:

…

Hmmm. If you have certs for domains other than the main "host," mechanic is not currently looking for those and is not bundling references to them into its conf file. This is something we should work on. This is the first time we've had a case where it made sense to have secure certificates for the aliases as well as the main domain. On Mon, Apr 16, 2018 at 3:37 PM, matadur ***@***.***> wrote: > It's not redirecting in the browser; the URL bar still shows the alias, > e.g. myalias.mysite.com. > > I've tried multiple browsers and networks also. > > Is there something I need to manually configure in nginx to get it to > redirect the browser? > > — > You are receiving this because you commented. > Reply to this email directly, view it on GitHub > <#11 (comment)>, > or mute the thread > <https://github.com/notifications/unsubscribe-auth/AAB9fVUjvSY6cAn- hFMI8dcTtVKvfQTRks5tpPLjgaJpZM4TVstR> > . > -- *THOMAS BOUTELL, CHIEF SOFTWARE ARCHITECT* P'UNK AVENUE | (215) 755-1330 | punkave.com — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#11 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ACBAa9kf0kUz3Yk_odepmUvr-rN-LB2Fks5tpPQHgaJpZM4TVstR> .

[boutell]

Well if there is only one cert involved, then I would expect it to work. Very hard to sort this out without access to the situation.