# Letsencrypt setup with multiple domains on same server

**URL:** https://discourse.roots.io/t/letsencrypt-setup-with-multiple-domains-on-same-server/7133
**Category:** trellis
**Created:** 2016-07-06T07:11:43Z
**Posts:** 23

## Post 1 by @aitor — 2016-07-06T07:11:44Z

I have a website running with letsencrypt enabled:

> **[Lola Fonseca | Pintura en seda](https://stage.lolafonseca.com/)**
>
> Pintura en seda el Lola Fonseca

It seems to work, but it prompt me to add a security exception because certificate is wrong configured:

I get this in Chrome: NET::ERR\_CERT\_AUTHORITY\_INVALID  
I get this in Firefox: SEC\_ERROR\_UNKNOWN\_ISSUER

What I did:

**Edit group vars:**

```
ssl:
      enabled: true
      provider: letsencrypt
env:
      wp_home: https://stage.lolafonseca.com
      wp_siteurl: https://stage.lolafonseca.com/wp
```

**I ran:**

```
ansible-playbook server.yml -e env=staging -K --tags wordpress
ansible-playbook server.yml -e env=staging -K --tags letsencrypt
```

What am I missing? Thanks!

---

## Post 2 by @aitor — 2016-07-06T10:45:21Z

I found the docs about it

> **[SSL | Trellis Documentation | Roots](https://roots.io/trellis/docs/ssl/#lets-encrypt)**
>
> Trellis offers SSL/HTTPS with Let’s Encrypt, along with manually provided certificates and self-signed certificates for local development environments.

Forget this thread, please :upside_down:

---

## Post 5 by @cfx — 2016-07-06T11:30:29Z

Thanks for posting your troubleshooting steps. This could be a good thread for users experiencing the same issue.

What was your issue and how did you solve it?

Was it your DNS entries for the www. prefixed domain?

---

## Post 6 by @aitor — 2016-07-06T11:51:25Z

I was reading the SSL docs but I have no solution yet. I found this description of the problem wich seems to fit to mine:

> ## Staging
> 
> Let’s Encrypt has rate limits for their production/real certificates.  
> While Trellis will prevent these rate limits from being hit, if you  
> want to test out LE integration, you can use their staging server to get  
> a “fake” certificate.

> Note that browsers will display an error/warning that they don’t  
> recognize the Certificate Authority so this should only be used for  
> testing purposes.

> ###Just set the following variable: in a group\_vars file  
> letsencrypt\_ca: “[https://acme-staging.api.letsencrypt.org](https://acme-staging.api.letsencrypt.org)”

So, I put this variable into `group_vars/staging/main.yml`

Then, I reprovision server and the problem remains.  
Any help will be appreciated.

DNS management is outside Digital Ocean (until old web stops). I have an A record in the domain provider:  
`stage.lolafonseca.com` pointing to my DO droplet IP

I still researching about www prefix and redirection.

---

## Post 7 by @aitor — 2016-07-06T13:00:51Z

How shoud be the DNS record for a stage subdomain with www prefix?

I’ve added A reccord  
`www.stage.lolafonseca.com`

Is it right?

Does not work yet (maybe beacuse DNS propagation)

---

## Post 8 by @cfx — 2016-07-06T13:53:13Z

If I don’t plan on having any subdomains I usually just add a CNAME with an asterisk that points to the domain.

Your setup is working now; I can ping the address with and without the www. and they both resolve to the same IP.

---

## Post 9 by @aitor — 2016-07-06T14:03:27Z

Ok, so problem persists with right DNS: Browser alerts that is a insecure server. On a staging server. I gess this warning will disappear on production.

---

## Post 10 by @aitor — 2016-07-15T15:27:25Z

Hi, after install from scratch a new bedrock project in the same droplet, I get the same results. Browser tell me that is a insecure server:

[https://abralaboca.net/](https://abralaboca.net/)

Why? I read caerfully the SSL docs and my configuration seems to be all right. The SSL Test labs tell me that is a non trusted certificate:

[https://www.ssllabs.com/ssltest/analyze.html?d=abralaboca.net](https://www.ssllabs.com/ssltest/analyze.html?d=abralaboca.net)

There are several possible reasons but I have no idea how to detect it and how to fix it.

Any clue or suggestion will be very appreciated! Thanks.

---

## Post 11 by @cfx — 2016-07-15T15:44:31Z

> I read caerfully the SSL docs and my configuration seems to be all right.

What is your configuration? Also, are you able to check your server logs for any mention of a problem? What about the terminal output during provisioning?

---

## Post 12 by @aitor — 2016-07-15T15:50:50Z

Thanks for response! I’m going to gather the data for post it.

---

## Post 13 by @fullyint — 2016-07-15T16:21:04Z

For `https://abralaboca.net/` you might double-check that this is not being applied:

```
letsencrypt_ca: "https://acme-staging.api.letsencrypt.org"
```

The [ssl docs](https://roots.io/trellis/docs/ssl/) mention that

> Note that browsers will display an error/warning that they don’t recognize the Certificate Authority so this should only be used for testing purposes.

If you want to use that fake cert authority to avoid rate limits on staging, be sure to only define `letsencrypt_ca` with that `staging` cert authority in a `group_vars/staging` file.

If you want a real cert for production, be sure you are not defining `letsencrypt_ca` with that `staging` cert authority anywhere in `group_vars/all` or `group_vars/production` etc.

* * *

As for `www.stage.lolafonseca.com`, I haven’t looked closely but it may be an instance of the as-yet-unresolved issue of `www` + subdomains not redirecting, as reported in response to [roots/trellis#570](https://github.com/roots/trellis/pull/570#commitcomment-17137346). If that is relevant, there is more discussion here [Problems with .com.au domains?](https://discourse.roots.io/t/problems-with-com-au-domains/6680)

---

## Post 14 by @aitor — 2016-07-15T16:38:35Z

Yes, actually even I deleted `letsencrypt_ca` variable from staging files too (until I get things working).

---

## Post 15 by @aitor — 2016-07-15T17:09:24Z

**What is your configuration?** As I said in the first post.  
**Terminal output during provisioning** : [http://pastebin.com/ySXEzqY1](http://pastebin.com/ySXEzqY1)  
**Nginx error log:** [http://pastebin.com/d1XKhFtg](http://pastebin.com/d1XKhFtg) (there are several SSL errors)

---

## Post 16 by @cfx — 2016-07-15T17:23:27Z

So you’re using multisite with domain mapping? That’s a pretty important detail you left out.

Please check this thread: [Let's Encrypt issue when adding new domain to multisite](https://discourse.roots.io/t/lets-encrypt-issue-when-adding-new-domain-to-multisite/7021)

Also, can we see your `wordpress_sites.yml`? You can mask domain names if you like.

---

## Post 17 by @aitor — 2016-07-15T22:16:50Z

Of course. Here it is: [http://pastebin.com/X6AmztzA](http://pastebin.com/X6AmztzA)

I have

```
multisite:
      enabled: false
      subdomains: false
```

In all domains

I’m going to read the refered post. Thank you.

---

## Post 18 by @cfx — 2016-07-16T03:52:44Z

Ok so you’re just using multiple domains on one box without multisite. Please try this: [Let’s Encrypt issue when adding new domain to multisite](https://discourse.roots.io/t/lets-encrypt-issue-when-adding-new-domain-to-multisite/7021/9?u=cfx) and add `-vvvv` to the end of the command in step #3. Paste output so we can see it. Thanks!

---

## Post 19 by @aitor — 2016-07-16T08:27:51Z

I tried it:

1. Remove certificates  
`$ sudo rm -rf /var/lib/letsencrypt /usr/local/letsencrypt /srv/www/letsencrypt /etc/nginx/ssl/letsencrypt /etc/ssl/certs/lets-encrypt-x3-cross-signed.pem`

2. Generate new certificates  
`ansible-playbook server.yml -e env=production -K --tags letsencrypt`

3. Reboot remote machine

4. Start Nginx

With same results. This is the output of provision with letsencrypt tag (verbose mode):  
[http://pastebin.com/GRuQciSs](http://pastebin.com/GRuQciSs)

I don’t know if it is meaningfull, there is no `etc/cron.d/letsencrypt-certificate-renewal`:

```
$ cat /etc/cron.d/letsencrypt-certificate-renewal
cat: /etc/cron.d/letsencrypt-certificate-renewal: No such file or directory
```

---

## Post 20 by @fullyint — 2016-07-16T15:33:18Z

@aitor reviewing your pasted output, I don’t see any `letsencrypt` tasks running. This leaves me wondering if you’re running an older version of Trellis before the `letsencrypt` role was added. Please confirm whether the `letsencrypt` role appears in these places:

- `/Volumes/B/Documentos/trellis2/ansible/roles` ([compare](https://github.com/roots/trellis/tree/03dd92ae45163b52be81381c550425970442dae3/roles))
- `/Volumes/B/Documentos/trellis2/ansible/roles/server.yml` ([compare](https://github.com/roots/trellis/blob/03dd92ae45163b52be81381c550425970442dae3/server.yml#L31))

---

## Post 21 by @cfx — 2016-07-16T15:35:01Z

Yes that had me scratching my head too. Thanks @fullyint.

---

## Post 22 by @aitor — 2016-07-16T15:50:31Z

I confirm. There is no letsencrypt roles :sweat:  
Excuse my ignorance

---

## Post 23 by @aitor — 2016-07-17T06:09:04Z

After trellis update I have all my sites working with SSL:

[https://telmo.club](https://telmo.club)

Thanks a lot for the help @cfx @fullyint