search

evertramos / nginx-proxy-automation

Automated docker nginx proxy integrated with letsencrypt.
MIT License
2.66k stars 632 forks source link

[BUG] Composed Subdomains from Cloudfare emit SSL_ERROR_NO_CYPHER_OVERLAP #335

Closed surister closed 2 years ago

surister commented 2 years ago

Describe the bug When using sub1.sub2.domain.tld Https connection fails with SSL_ERROR_NO_CYPHER_OVERLAP

sub2.domain.tld works though.

To Reproduce Steps to reproduce the behavior:

  1. Fully manage the DNS in Cloudfare.
  2. All records are set on proxy.
  3. docker run -e VIRTUAL_HOST=sub2.sub1.domain.tld -e LETSENCRYPT_HOST=sub2.sub1.domain.tld --network nginx_proxy nginx
  4. See error.

The exact same command docker run -e VIRTUAL_HOST=sub1.domain.tld -e LETSENCRYPT_HOST=sub1.domain.tld --network nginx_proxy nginx without sub2 works fine.

DNSs are practically the same: CNAME sub2.sub1 IN domain.tld CNAME sub1 IN domain.tld

Expected behavior I expect it to work, I works if you don't use Cloudfare.

Note I am aware that this is most likely a Cloudfare Issue, in the beginning I had the same issue as #238 and I managed to solve it through that issue, I am wondering if anyone more experienced with Cloudfare knows what's going on.

Thanks in advance.

evertramos commented 2 years ago

@surister this is a limitation of CloudFlare certificate for you plan. If you uptrade to CloudFlare Pro you will not have this issue. Or try to by pass CloudFlare and you will see this is not related with the proxy.

theIanMilan commented 2 years ago

Just thought I'd share the CloudFlare documentation on the limitation for other people who might stumble onto this thread like I did

https://community.cloudflare.com/t/subdomain-too-deep/81872

The Cloudflare universal certificates cover example.com and *.example.com. This means that it covers any subdomain one level below the domain you signed up with.

It will cover www.example.com and subdomain.example.com, as these are one level below the root domain, example.com.

The certificate will not cover www.subdomain.example.com or a.b.example.com, however, as these subdomains are too deep.

Solution: You either need the $10/month Advanced Certificate Manager from Cloudflare, on which you can specify the subdomain you need to cover, or to set the record to :grey: and bypass Cloudflare altogether.