SSL ignored on subdomains
I have an SSL certificate only for the top level domain (e.g. https://mycompany.com) and have a subdomain (http://blog.mycompany.com) that points via DNS to a blog on Tumblr.
My nginx server config looks like this:
server {
listen 80;
server_name mycompany.com;
return 301 https://mycompany.com$request_uri;
}
server {
listen 443 ssl;
listen [::]:443 ipv6only=on;
ssl on;
ssl_certificate /etc/nginx/ssl/ssl.cer;
ssl_certificate_key /etc/nginx/ssl/ssl.key;
# Add perfect forward secrecy
ssl_prefer_server_ciphers on;
# Add HSTS
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains";
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
server_name mycompany.com;
location / {
proxy_pass http://localhost:3001;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
}
}
My DNS record looks like this:
CNAME blog domains.tumblr.com.
If I try accessing http://blog.mycompany.com then it gets redirected to the https version and there's a Server Not Found error in my browser. Do I need to make changes to the DNS records or in Nginx?