即使应用了重定向，WWW 子域也不安全

Question

我正在尝试将 'www' 子域重定向到没有 'www' 的同一路由，但是在访问该地址时我收到以下错误：

您的连接不是私人的攻击者可能试图从 www.*.com 窃取您的信息（例如，密码、消息或信用卡）。学到更多 NET::ERR_CERT_COMMON_NAME_INVALID

没有 'www' 的子域已完全激活并设置了我使用 Lets Encrypt 创建的 SSL（两个版本的子域均在创建 SSL 时注册）。

在 'www' 域上执行 curl 命令时，我成功获得了“301 永久移动”。

这是我的nginx的配置文件：

# HTTP — redirect all traffic to HTTPS
server {
    listen 80;
    listen [::]:80 default_server ipv6only=on;
    return 301 sitename.com$request_uri;
}

# HTTPS — proxy all requests to the Node app
server {
    # Enable HTTP/2
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name sitename.com;

    # Use the Let’s Encrypt certificates
    ssl_certificate /etc/letsencrypt/live/sitename.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/sitename.com/privkey.pem;

    # Include the SSL configuration from cipherli.st
    include snippets/ssl-params.conf;

    location / {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-NginX-Proxy true;
        proxy_pass http://localhost:4000/;
        proxy_ssl_session_reuse off;
        proxy_set_header Host $http_host;
        proxy_cache_bypass $http_upgrade;
        proxy_redirect off;
    }
}

Answer 1

已编辑，见评论

您可以尝试更完整的解决方案。使用通配符和改进的重定向。请尝试一下！

# HTTP — redirect all traffic to HTTPS
server {
    listen 80;
    listen [::]:80 default_server ipv6only=on;

    server_name .sitename.com;     # Note the '.' before sitename!

    return 301 https://$host$request_uri;
}

# HTTPS — proxy all requests to the Node app
server {
    # Enable HTTP/2
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name .sitename.com;

    # Use the Let’s Encrypt certificates
    ssl_certificate /etc/letsencrypt/live/sitename.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/sitename.com/privkey.pem;

    # Include the SSL configuration from cipherli.st
    include snippets/ssl-params.conf;

    location / {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-NginX-Proxy true;
        proxy_pass http://localhost:4000/;
        proxy_ssl_session_reuse off;
        proxy_set_header Host $http_host;
        proxy_cache_bypass $http_upgrade;
        proxy_redirect off;
    }
}

Docs

.sitename.com;

A special wildcard name in the form “.example.org” can be used to match both the exact name “example.org” and the wildcard name “*.example.org”.

Answer 2

我决定以另一种方式解决这个问题。我为 'www' 子域生成了另一个 Lets Encrypt SSL 证书并创建了另一个块。

现在一切正常。

这是我更新的配置：

# HTTP — redirect all traffic to HTTPS
server {
    listen 80;
    server_name sitename.com www.sitename.com;
    listen [::]:80 default_server ipv6only=on;
    return 301 https://$host$request_uri;
}

# HTTPS — proxy all requests to the Node app
server {
    # Enable HTTP/2
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name sitename.com;

    # Use the Let’s Encrypt certificates
    ssl_certificate /etc/letsencrypt/live/sitename.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/sitename.com/privkey.pem;

    # Include the SSL configuration from cipherli.st
    include snippets/ssl-params.conf;

    location / {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-NginX-Proxy true;
        proxy_pass http://localhost:4000/;
        proxy_ssl_session_reuse off;
        proxy_set_header Host $http_host;
        proxy_cache_bypass $http_upgrade;
        proxy_redirect off;
    }
}

# HTTPS — proxy all requests to the Node app
server {
    # Enable HTTP/2
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name www.sitename.com;

    # Use the Let’s Encrypt certificates
    ssl_certificate /etc/letsencrypt/live/www.sitename.com-0001/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/www.sitename.com-0001/privkey.pem;

    # Include the SSL configuration from cipherli.st
    include snippets/ssl-params.conf;

    location / {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-NginX-Proxy true;
        proxy_pass http://localhost:4000/;
        proxy_ssl_session_reuse off;
        proxy_set_header Host $http_host;
        proxy_cache_bypass $http_upgrade;
        proxy_redirect off;
    }
}

即使应用了重定向，WWW 子域也不安全

WWW subdomain not secured even though redirection is applied

dns

ssl

nginx

digital-ocean