How to set up domains & certificates for root doman and www subdomain

Thanks to everyone who took the time to answer my questions. In the process of attempting to fix the certificates, I ended up with some certbot error messages I wasn’t able to resolve.

Long story short … I recreated the droplet from scratch (this time, with plenty of snapshots along the way in case I messed something up, and good notes on all the steps involved), and by following exactly all the Digital Ocean tutorials, I was able to set up SSH, Apache, firewalld, VirtualHost, certificates for both the root and www domains, and a cron task to automatically renew the certificates when needed; and lastly, succesfully tested on Qualys SSL Labs website.

Thanks!

Hi,

As @bobbyiliev mentioned above, you do not need to separate vhost for www subdomain of foo.dev, unless their contents differ. But let’s try to solve your configuration problem as it is now. I mean two domains with two separate certificates.

Prerequisites. You use standard Centos8 droplet with all additional packages installed from official repositories.

Step 1. Modify ssl.conf file.

a. Make a copy of this file, just in case.

sudo cp /etc/httpd/conf.d/ssl.conf /etc/httpd/conf.d/ssl.conf.original

b. Comment (or remove) all lines of SSL Virtual Host Context (starting with <VirtualHost default:443>, and ending with </VirtualHost>), and save the file.

Step 2. Modify config files of your virtual hosts

<VirtualHost *:80>
  ServerName foo.dev
  Redirect permanent / https://foo.dev/
</VirtualHost>

<IfModule mod_ssl.c>
  <VirtualHost *:443>
    ServerName foo.dev  
    DocumentRoot /var/www/foo.dev  
    ErrorLog /var/log/httpd/foo.dev-error.log  
    CustomLog /var/log/httpd/foo.dev-access.log combined
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/foo.dev/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/foo.dev/privkey.pem
  </VirtualHost>
</IfModule>

<VirtualHost *:80>
  ServerName www.foo.dev
  Redirect permanent / https://www.foo.dev/
</VirtualHost>
 
<IfModule mod_ssl.c>
  <VirtualHost *:443>
    ServerName www.foo.dev
    DocumentRoot /var/www/foo.dev    
    ErrorLog /var/log/httpd/www.foo.dev-error.log    
    CustomLog /var/log/httpd/www.foo.dev-access.log combined
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/www.foo.dev/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/www.foo.dev/privkey.pem
  </VirtualHost>
</IfModule>

Step 3. Restart Apache service and check if it is running OK

sudo systemctl restart httpd

sudo systemctl status httpd

In addition, you may want to improve your SSL/TLS configuration making it more strict, and/or add some logging options to it.

Hi there @larry99,

I believe that there is no need to have duplicate Vhosts for both www and non-www unless you want to show different content.

If this is not the case rather than having a separate Vhost for your www and your non-www versions, I would recommend adding your www version as a server alias to your main Vhost and removing the duplicate.

So your main Vhost will look like this:

<VirtualHost *:80>
    ServerName foo.dev
    ServerAlias www.foo.dev

    DocumentRoot /var/www/foo.dev
    ErrorLog /var/log/httpd/foo.dev-error.log
    CustomLog /var/log/httpd/foo.dev-access.log combined
</VirtualHost>

Then disable the /etc/httpd/conf.d/www.foo.dev.conf config.

That way when you generate the SSL certificate, it would include both the www and non-www in the certificate.

Let me know how it goes. Regards, Bobby