让加密子域不安全

Question

我的域（domain.com和www.domain.com）有一个LetsEncrypt SSL证书。现在，我想在证书中添加workflow.domain.com。我尝试使用certbot的展开选项，命令如下：

certbot -d domain.com -d www.domain.com -d workflow.domain.com --expand

Certbot返回成功响应。但是，浏览器仍然显示不安全……

所以，我已经吊销了证书，开始清理。

我用< code>certbot - apache运行了certbot。它正确地显示了我的3个选项，因此我选择将这3个选项都包含在证书中。

certbot返回时没有错误，尽管浏览器在< code>workflow.domain.com上一直显示我不安全？

< code>certbot证书的输出如下所示:

Saving debug log to /var/log/letsencrypt/letsencrypt.log

-------------------------------------------------------------------------------
Found the following certs:
  Certificate Name: domain.com
    Domains: domain.com workflow.domain.com www.domain.com
    Expiry Date: 2019-12-20 15:05:24+00:00 (VALID: 89 days)
    Certificate Path: /etc/letsencrypt/live/domain.com/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/domain.com/privkey.pem
-------------------------------------------------------------------------------

请注意，其他 2 个域（domain.com 和 www.domain.com）显示为安全

子域的虚拟主机配置如下所示：

<IfModule mod_ssl.c>
<VirtualHost *:443>
        ServerName workflow.domain.com

        serverAdmin [e-mail]
        DocumentRoot /var/www/Domain/Workflow

        <Directory /var/www/Domain/Workflow>
                Options Indexes FollowSymLinks MultiViews
                AllowOverride All
                Order allow,deny
                allow from all
        </Directory>

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

AddType application/x-font-ttf                  ttc ttf
AddType application/x-font-otf                  otf
AddType application/font-woff                   woff
AddType application/font-woff2                  woff2
AddType application/vnd.ms-fontobject           eot
RewriteEngine on
# Some rewrite rules in this file were disabled on your HTTPS site,
# because they have the potential to create redirection loops.

# RewriteCond %{SERVER_NAME} =domain.com [OR]
# RewriteCond %{SERVER_NAME} =www.domain.com
# RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/domain.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/domain.com/privkey.pem
</VirtualHost>
</IfModule>

Answer 1

我只需在docker-compose.yml文件中将这个标志添加到certbot服务中:(- expand -d someone.me，www.someone.me，bo.someone.me)

command: certonly --webroot --webroot-path=/var/www/html --email [e-mail] --agree-tos --no-eff-email --force-renewal --expand -d someone.me,www.someone.me,bo.someone.me

Answer 2

问题是缺少对https的重定向。重写代码在子域上注释。您可以将这些行添加到vhost配置中：

RewriteCond %{SERVER_NAME} = workflow.domain.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

请考虑编辑问题，使其反映实际问题。