Various problems with wildcard SSL certs on WordPress Multisite

Bronislawsky commented 4 years ago

Sorry for over posting.. but I can't seem to get it working,.. I try to deploy a wp multisites subdomain,

ss-config SITE_TLD="domain.xyz" SITE_DOMAIN="domain.xyz" WP_MULTISITE="true" WP_MULTISITE_SUBDOMAINS="true" WP_MULTISITE_DOMAIN_MAPPING="false" SSL_EMAIL="user@example.com" SSL_EMAIL_ALERTS="false"

with these settings I get to this point

not a subdomain + does not contain www + no email alerts (or missing)

certbot delete --cert-name domain.xyz certbot certonly --noninteractive --agree-tos --cert-name domain.xyz -d domain.xyz -d www.domain.xyz --register-unsafely-without-email --webroot -w /var/www/html/

That doesn't gives me a wildcard for multisite... it got catch by the if's before it reaches the multisites section,

to force the script to reach the 'multisites' section I added [[ "$WP_MULTISITE" != "true" ]] && to all the if's before the multisites sections then I get to this

multisite (subdomains) + main site not a subdomain + main site does not contain www + no email alerts

certbot delete --cert-name domain.xyz certbot certonly --noninteractive --agree-tos --cert-name domain.xyz -d *.domainxyz -d domainxyz --register-unsafely-without-email --webroot -w /var/www/html/ now I think it reaches the 'right' if block but here is the problem I think.. in the parsing

SITE_DOMAIN_ONE="*.${SITE_DOMAIN//**$www**./}"
SITE_DOMAIN_TWO="${SITE_DOMAIN//**$www**./}"

the "$www" gets evaluated as an empty var the the dot of the domain gets stripped

multisite (subdomains) + main site not a subdomain + main site does not contain www + no email alerts

ZZZZ certbot delete --cert-name domain.xyz certbot certonly --noninteractive --agree-tos --cert-name domain.xyz -d *.domainxyz -d domainxyz --register-unsafely-without-email --webroot -w /var/www/html/

if I replace by

SITE_DOMAIN_ONE="*.${SITE_DOMAIN//www./}"
SITE_DOMAIN_TWO="${SITE_DOMAIN//www./}"

without the $www

It seems to work.

I noticed the "$www." in others of block too

jessuppi commented 4 years ago

Just a note that WP Multisite is not yet supported on SlickStack, in general. We have experimental Nginx server blocks but it is not yet officially working.

I'll keep this Issue open for now and mention when Nginx/SSL issues are fixed.

jessuppi commented 2 years ago

Please see my other comment for related information: https://github.com/littlebizzy/slickstack/issues/34#issuecomment-1060439726

In regard to WordPress Multisite, we recently decided (after lots of discussion on Discord) that it's not going to be a big priority for SlickStack vs. single sites going forward, because it would essentially require our team to maintain 2 versions of SlickStack in order to maintain optimized security and performance settings for both versions.

The biggest challenge is SSL certificates. Going forward, SlickStack will only support OpenSSL (self-signed) certs for Multisite installations and we have no plans to ever support Let's Encrypt.

ANYONE READING THIS: Consider WordPress Multisite on SlickStack to be experimental and insecure... use at your own risk and assume that the file structure and permissions (etc) are vulnerable in multi-user situations.

That said, WP Multisite should "work" now as long as you select OpenSSL only.

littlebizzy / slickstack