HSTS not working on subdomain

Discussion in 'Server Operation' started by Piotrek, Apr 30, 2019.

  1. Piotrek

    Piotrek New Member

    I have on the server the software: Ubuntu 18.04.2 LTS with nginx/1.14.0 (Ubuntu) installed with use apt-get. Nginx has modules:
    Code:
    [email protected]:/etc/nginx/sites-enabled# nginx -V 2>&1 | tr -- - '\n' | grep module
    modules
    path=/usr/lib/nginx/modules
    http_ssl_module
    http_stub_status_module
    http_realip_module
    http_auth_request_module
    http_v2_module
    http_dav_module
    http_slice_module
    http_addition_module
    http_geoip_module=dynamic
    http_gunzip_module
    http_gzip_static_module
    http_image_filter_module=dynamic
    http_sub_module
    http_xslt_module=dynamic
    stream_ssl_module
    mail_ssl_module
    I have there two websites: subdomain.example.com and subdomain2.example.com. Both use own vhost file with the same ssl part:
    Code:
        ssl_protocols TLSv1.2;
        ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
        ssl_prefer_server_ciphers on;
    
        # HSTS
        add_header Strict-Transport-Security "max-age=31536000";
    
        # XSS Protection
        add_header X-XSS-Protection "1; mode=block";
    
        # Clickjacking
        add_header X-Frame-Options "SAMEORIGIN";
    
        # X-Content Type Options
        add_header X-Content-Type-Options nosniff;
    
        # OCSP Stapling
        # fetch OCSP records from URL in ssl_certificate and cache them
        ssl_stapling on;
        ssl_stapling_verify on;
        ssl_trusted_certificate /etc/letsencrypt/live/subdomain.example.com/chain.pem; //subdomain2.example.com has own LE ssl certificate
    
        ssl_certificate /etc/letsencrypt/live/subdomain.example.com/fullchain.pem; # managed by Certbot //subdomain2.example.com has own LE ssl certificate
        ssl_certificate_key /etc/letsencrypt/live/subdomain.example.com/privkey.pem; # managed by Certbot //subdomain2.example.com has own LE ssl certificate
    
    Both websites have added HSTS header but only one works (ssllabs.com --> grade A+ "HTTP Strict Transport Security (HSTS) with long duration deployed on this server." but on second one is grade A without this message). Moreover for subdomain with grade A+ there is an information "This site works only in browsers with SNI support." but this with grade A does not have this message. I really don't understand what happens here. Nginx has default config.
     
    Last edited: May 7, 2019
  2. ruliezz

    ruliezz Member

    Did you certificate is generate for both domains?
     
  3. Piotrek

    Piotrek New Member

    No, I did
    Code:
    certbot --nginx -d subdomain.example.com -d www.subdomain.example.com
    for first and
    Code:
    certbot --nginx -d subdomain2.example.com -d www.subdomain2.example.com
    for second website. Moreover there are also two separate directories inside /etc/letsencrypt/live.
    PS
    Both websites use own vhost file with the same ssl part as I mentioned earlier.
     

Share This Page