Admin login issues on Multisite subdomains (TLD) with Let's Encrypt (LE) SSL (plus Cloudflare proxied and SSL/TLS)

cawalle · March 12, 2024, 6:10pm

Hi,

I can’t access the wp-admin of certain subdomains in my Multisite setup.

Basically, I have a mainsite.com, with several subdomains (which mostly - but not all - have their own top level domain). So, e.g., out of the following, I can access all of their frontends (but not all of their backends).

mainsite.com
- (✓ frontend ✓ backend)
subdomain.mainsite.com
- (✓ frontend ✓ backend)
mainsite.de (notice the .de TLD)
- (✓ frontend ✓ backend (after being once prompted to login again))
anotherdomain.com
- (✓ frontend ~~X backend~~)
yetanotherdomain.com
- (✓ frontend ~~X backend~~)

The surprising one, is that mainsite.de works, while other domains, such as anotherdomain.com are stuck on the infinite login loop with this warning:

Error: Cookies are blocked or not supported by your browser. You must enable cookies to use WordPress.

There are several similar topics out there, most often referencing a variation of define('COOKIE_DOMAIN', …); as the solution, and adding several other lines to application.php (sometimes with a '/' sometimes without '') … I have tried all of the ones that are (partly commented) out in my application.php, but couldn’t get it to work.

My setup

I am using Cloudflare for DNS, use their proxy (orange cloud), and have SSL/TLS on strict(full) for all domains (mainsite.com, mainsite.de, anotherdomain.com, yetanotherdomain.com…)
I use Let’s Encrypt for the certifictes though (via Trellis, see below)
Here are my addtions to application.php (as noted I have also tried some of the commented out versions, and am unsure which one is actually state of the art?)

roots/site_mainsite/config/application.php

 /* Multisite */
Config::define('WP_ALLOW_MULTISITE', true);

Config::define('MULTISITE', true);
Config::define('SUBDOMAIN_INSTALL', true); // Set to true if using subdomains
Config::define('DOMAIN_CURRENT_SITE', env('DOMAIN_CURRENT_SITE'));
Config::define('PATH_CURRENT_SITE', env('PATH_CURRENT_SITE') ?: '/');
Config::define('SITE_ID_CURRENT_SITE', env('SITE_ID_CURRENT_SITE') ?: 1);
Config::define('BLOG_ID_CURRENT_SITE', env('BLOG_ID_CURRENT_SITE') ?: 1);


// Config::define('COOKIE_DOMAIN', '');
// Config::define('COOKIE_DOMAIN', false);
// Config::define('COOKIE_DOMAIN', env('DOMAIN_CURRENT_SITE'));

Config::define('ADMIN_COOKIE_PATH', '/');
Config::define('COOKIEPATH', '/');
Config::define('SITECOOKIEPATH', '/');
Config::define('PLUGINS_COOKIE_PATH', '/');

// Config::define('COOKIE_DOMAIN', '');
Config::define('COOKIE_DOMAIN', $_SERVER['HTTP_HOST']);

and here is my wordpress_sites.yml

roots/trellis/group_vars/production/wordpress_sites.yml

# Created by trellis-cli v1.11.1
# Documentation: https://roots.io/trellis/docs/wordpress-sites/

wordpress_sites:
  mainsite.com:
    site_hosts:
    - canonical: mainsite.com
      redirects:
      - www.mainsite.com
    - canonical: mainsite.de
      redirects:
        - www.mainsite.de      
    - canonical: subdomain.mainsite.com
    - canonical: anotherdomain.com
      redirects:
        - www.anotherdomain.com
    - canonical: yetanotherdomain.com
      redirects:
        - www.yetanotherdomain.com
    local_path: ../site_mainsite
    branch: master
    repo: git@github.com:username/roots.git
    repo_subtree_path: site_mainsite
    multisite:
      enabled: true
      subdomains: true
    ssl:
      enabled: true
      provider: letsencrypt
      hsts_include_subdomains: true
    cache:
      enabled: false
      skip_cache_uri: /wp/wp-admin/|/wp/wp-json/|/wp/xmlrpc.php|wp/wp-.*.php|/wp-admin/|/wp-json/|/xmlrpc.php|wp-.*.php|/feed/|index.php|sitemap(_index)?.xml|/store.*|/cart.*|/my-account.*|/checkout.*|/addons.*|/warenkorb.*|/mein-konto.*|/kasse.*|/addons.*
      skip_cache_cookie: comment_author|wordpress_[a-f0-9]+|wp-postpass|wordpress_no_cache|wordpress_logged_in|woocommerce_cart_hash|woocommerce_items_in_cart|wp_woocommerce_session_
    env:
      domain_current_site: mainsite.com```

here are some tables from the database (seems correct to me?)

Database tables

wp_blogs
1 1 mainsite.com / 2024-03-12 17:04:05 0000-00-00 00:00:00 1 0 0 0 0 0
2 1 mainsite.de / 2024-03-12 17:05:23 2024-03-12 17:05:23 1 0 0 0 0 0
3 1 anotherdomain.com / 2024-03-12 17:05:31 2024-03-12 17:05:31 1 0 0 0 0 0
4 1 yetanotherdomain.com / 2024-03-12 17:05:56 2024-03-12 17:05:56 1 0 0 0 0 0
5 1 dasist.mainsite.com / 2024-03-12 17:06:19 2024-03-12 17:06:19 1 0 0 0 0 0

wp_site
1 mainsite.com /

wp_sitemeta
15 1 siteurl mainsite.com
18 1 subdomain_install 1

wp_options
1 siteurl https://mainsite.com/wp yes
2 home https://mainsite.com/wp yes

wp_2_options
1 siteurl https://mainsite.de yes
2 home https://mainsite.de yes

wp_3_options
1 siteurl https://anotherdomain.com yes
2 home https://anotherdomain.com yes

wp_4_options
1 siteurl https://yetanotherdomain.com yes
2 home https://yetanotherdomain.com yes

wp_5_options
1 siteurl https://subdomain.mainsite.de yes
2 home https://subdomain.mainsite.de yes

seemed to me that regardless of the multisite-url-fixer plugin activated or deactivated, the error persists … … (is that plugin still needed / recommended?)
the behavior in the backend is like this:

behavior clicking the 'Dashboard' link of different domains

the Dashboard link for subdomain.mainsite.com directly links to the wp-admin of the correct subsite
the Dashboard link for mainsite.de redirects to: https://mainsite.de/wp/wp-login.php?redirect_to=https%3A%2F%2Fmainsite.de%2Fwp%2Fwp-admin%2F&reauth=1) → and here the login via admin works (and then also - seemingly - is not required anymore)
however clicking on Dashboard for anotherdomain.com redirects to: https://anotherdomain.com/wp/wp-login.php?redirect_to=https%3A%2F%2Fanotherdomain.com%2Fwp%2Fwp-admin%2F&reauth=1) and from there doesn’t log in, but loops through to https://anotherdomain.com/wp/wp-login.php) where it throws the error: Error: Cookies are blocked or not supported by your browser. You must enable cookies to use WordPress.

What am I missing? It feels like I have read the first few pages on google, most if not all articles on this in the Roots Discourse, chatted with GPT for 10+ hours, and just can’t get it to work. I am out of solutions, and don’t know where to look, what’s wrong or where to “fix” this. (I have also tried doing this via Cloudflare certs instead, but it led to similar issues with logging in… see: Wordpress Multisite with Conditional SSL Certificates)

Can I even use Cloudflare proxy and TLS/SSL with LE (and multisite with subdomains and TLD subdomains) in conjunction? Or am I simply missing one configuration somewhere (that I just have been overlooking?)

Appreciate anyone, who can chime in on this or even has gotten this to work

craigpearson · March 12, 2024, 7:37pm

Hey so everything looks good with your shared config, this redirect loop often refers to a database issue or a cookie issue when not on cloudflare.

If some resolve but others don’t then I’d lean towards a database issue, however based on what you’ve shared that doesn’t appear to be the case.

Here are some other routes to explore or rule out:

Triple check your database entries match what you’ve provided above
Has the server provision completed successfully? If you have for example tried to provision with LE and it’s failed partway through the provision then maybe the nginx config isn’t set
Are there any redundant redirects configured on the problematic sites? i.e. with the Redirection plugin, or Yoast SEO
Try clearing your local DNS cache
Ensure that caching is disabled for your browser in inspector tools, this will help reduce the possibility of a cached redirect kicking in
Try clearing all your local session data for each site (cookies, local storage)
Make sure that the SSL Certificates include the www. and none www. counterparts for each domain
Ensure that your DNS Records contain www. entries, and */@ entries
Be sure you’re not attempting to login using incognito mode
I’ve noticed that you’ve mentioned in other posts you have maybe explored changing the nginx config files, could these changes need reverting?

adleviton · March 12, 2024, 7:57pm

I have some experience with a similar project, but there are some notable differences, as a disclaimer:

My multisite setup only uses different domains (not subdomains).
I’m using CloudFlare, with CloudFlare certs & keys, set to Full (Strict). I’m not using LetsEncrypt.

Some Thoughts:
Completely unrelated to this project, I ran into “Cookies are blocked or not supported by your browser”, which can be misleading. I needed to downgrade a plugin that was causing errors (unrelated to cookies) to solve this issue. I’d recommend disabling all plugins if not done so already. I’m not using any plugins such as “multisite-url-fixer” like you mentioned.

You’re using both different domains AND subdomains. I don’t expect this to be an issue with CloudFlare since their SSL certs include wildcard subdomains, but I wonder if Wordpress itself might have an issue? I honestly don’t know … I ask because I know it’s tricky to configure multisite to use different domains … and if you’re using different domains AND subdomains at the same time, I’m not sure what to expect.

If it helps, here’s my multisite config:

/* Multisite */
Config::define('WP_ALLOW_MULTISITE', true);
Config::define('MULTISITE', true);
Config::define('SUBDOMAIN_INSTALL', true); // Set to true if using subdomains
Config::define('DOMAIN_CURRENT_SITE', env('DOMAIN_CURRENT_SITE'));
Config::define('PATH_CURRENT_SITE', env('PATH_CURRENT_SITE') ?: '/');
Config::define('SITE_ID_CURRENT_SITE', env('SITE_ID_CURRENT_SITE') ?: 1);
Config::define('BLOG_ID_CURRENT_SITE', env('BLOG_ID_CURRENT_SITE') ?: 1);
Config::define('COOKIE_DOMAIN', $_SERVER['HTTP_HOST']);

For me, I also need to log into each admin area separately, and I believe this is normal. I would expect this to be the case for both different and subdomains.

Also, the Chrome web browser can have really annoying and aggressive caching. Sometimes I need to try a different browser and/or restart Chrome when I’m messing around with SSL.

cawalle · April 9, 2024, 7:49am

@craigpearson and @adleviton, thanks both of you for your detailed answers…
it actually ended up being a cache issue that was caused by a browser extension (or more precisely Brave Shield) that wasn’t immediately on my radar …

So, I marked Craig’s answer as the right one, as it indeed was a caching issue. Quite the oversight on my site … Anyways, both your answers helped me to really look at it again and actually find a solution!