Thanks for the follow-up!

I’m having someone check in on the DNS record and will update this when that’s verified.

I planned to enable HTTPS only on example.com and have HTTP only on subdomain.example.com, as a workaround for not having a wildcard certificate (but hadn’t implemented it yet because I got sidetracked). Thanks for the reminder – I’ll make those changes and see how it goes.

The Node.js is publicly accessible without Nginx and is using the Let’s Encrypt certificate. For a subdomain, should I still be doing proxypass https://example.com:3000 or instead something like proxypass https://*.example.com:3000?

Thank you so much! The initial problem was indeed due to the missing wildcard DNS record.

I’m including my final server blocks in case they’re helpful to anyone in the future. I have the same app running an https server on port 3000 and an http server on port 4000.

# Point http requests to https for example.com
server {
    listen 80;
    listen [::]:80;

    server_name example.com www.example.com;
    return 301 https://$server_name$request_uri;
}

# https requests for example.com
server {
    listen 443 ssl http2 default_server;
    listen [::]:443 ssl http2 default_server;
    include snippets/ssl-example.com.conf;
    include snippets/ssl-params.conf;

    root /var/www/html;
    index index.php index.html index.htm index.nginx-debian.html;

    server_name example.com;

    location / {
        proxy_pass https://example.com:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
    }

    location /blog {
        try_files $uri $uri/ /index.php$is_args$args;
    }

    # For Lets Encrypt certbot
    location ~ /.well-known {
        allow all;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php7.0-fpm.sock;
    }

    location ~ /\.ht {
        deny all;
    }

    location /favicon.ico { alias /var/www/html/example/favicon.ico; }
    location = /favicon.ico { log_not_found off; access_log off; }
    location = /robots.txt { log_not_found off; access_log off; allow all; }

}

# http requests for example.com subdomains
server {
    listen 80;
    listen [::]:80;

    server_name *.example.com;

    location / {
        proxy_pass http://example.com:4000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
    }

    location /favicon.ico { alias /var/www/html/example/favicon.ico; }
}

I also tried setting up a redirect from https –> http for subdomains, since I don’t have a certificate for the subdomains. This doesn’t seem to be working, all I get is the nginx startup page. I placed it under the example.com https requests server block. Is attempting to return http://$server_name$request_uri when server_name has a wildcard in it allowable?

# Re-route https subdomain requests to http
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    include snippets/ssl-example.com.conf;
    include snippets/ssl-params.conf;

    server_name *.example.com
    return 301 http://$server_name$request_uri;
}