Forum

Hi Hugo,

I can use the letsencrypt tool with no problem for all my primary domain but so far I haven't been able to get my subdomain to get me a green light.

Could you please advise on how to create certificate for domain and subdomain?

Thank you

There should be no difference in requesting a certificate for a domain and one for a subdomain. For the letsencrypt script, both are just hostnames. What exactly goes wrong?

Works for me. Not sure if adding support for aliases would also be useful like with certbot:

certbot-auto certonly --standalone -d example.com -d www.example.com -d ...

Is there a difference besides having a base domain?

At any rate, I remember getting half-stuck at this stage though (from the README):

After properly testing, open letsencrypt.conf, comment the testing CA hostname
(the LE_CA_HOSTNAME setting), uncomment the production CA hostname, register
your account key at the production server and request the final version of your
website certificate.

"register your account key" wasn't obvious to me, but I believe all I did was do ./letsencrypt -register example.com and then proceeded doing the same for the subdomains. After that I added the relevant keys to their respective VirtualHosts.

Hiawatha automatically uses all the hostnames from the specified VirtualHost section in the Hiawatha configuration as an alias.

Nice!

I suppose that doesn't work for subdomains in their own VirtualHost though (to do for example wiki.example.com instead of example.com/wiki).

If you have the following configuration

VirtualHost {
  Hostname = example.com, wiki.example.com
  ...
}

requesting a certificate for example.com via Hiawatha's letsencrypt script, you'll get a certificate that is valid for both example and wiki.example.com. The /wiki in example.com has nothing to do with any certificate. /wiki is not a subdomain. It's just a directory inside the hostname example.com.

I was thinking more:

VirtualHost {
  Hostname = example.com, www.example.com
  WebsiteRoot = /var/www/example
  StartFile = index.html
  ...
}

VirtualHost {
  Hostname = wiki.example.com
  WebsiteRoot = /var/www/example/wiki
  index.php
  ...
}

Would it still work for this? If so I've probably overdone it, lol.

I get an error if I comment out the respective certs for the other VirtualHosts though.

That will work, but you'll have to request two certificates. One for example.com (which will have an alias for www.example.com) and one for wiki.example.com.

Another question related to certificates (I posted on the weblog as well but not sure you read the weblog)

VirtualHost {
  Hostname = example.com, 127.0.0.1, www.example.com
  WebsiteRoot = /var/www/example
  StartFile = index.html
  ...
}

your LetsEncrypt script does not allow IP addresses in the list, could it pass on IP addresses instead (because I am using my site via http as well on the IP addresses) or should I change my configuration?

It's not that my script doesn't allow it. The Let's Encrypt CA doesn't allow it. And yes, of course I read the comments at my own weblog.

I managed to get it working using Hugo example

VirtualHost {
  Hostname = example.com, wiki.example.com
  ...
}

I will continue on the weblog for my different issue, Fred's one has been closed

thanks Hugo keep on the great job, I am a big fan of the Hiawatha webserver I have been using for more than 10 years