I’m back with another issue, this time with the www redirect. It’s failing because there’s no SSL certificate for the www subsubdomain. The subdomain works perfectly fine, but not the www subsubdomain that redirects to the subdomain.
Here’s the siteblock:
www.blog.domain.com {
redir https://blog.domain.com{uri} 301
}
blog.domain.com {
...
}
Here’s what I’m getting in the browser:
This site can’t provide a secure connection
www.blog.domain.com uses an unsupported protocol.
ERR_SSL_VERSION_OR_CIPHER_MISMATCH
Unsupported protocol
The client and server don't support a common SSL protocol version or cipher suite.
In Firefox:
Secure Connection Failed
An error occurred during a connection to www.domain.com. Cannot communicate securely with peer: no common encryption algorithm(s).
Error code: SSL_ERROR_NO_CYPHER_OVERLAP
The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
Please contact the website owners to inform them of this problem.Secure Connection Failed
An error occurred during a connection to www.domain.com. Cannot communicate securely with peer: no common encryption algorithm(s).
Error code: SSL_ERROR_NO_CYPHER_OVERLAP
The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
Please contact the website owners to inform them of this problem.
And in curl -v:
* Trying [IP redacted]:443...
* Connected to www.blog.domain.com (IP redacted) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.0 (IN), TLS header, Unknown (21):
* TLSv1.3 (IN), TLS alert, handshake failure (552):
* error:0A000410:SSL routines::sslv3 alert handshake failure
* Closing connection 0
curl: (35) error:0A000410:SSL routines::sslv3 alert handshake failure
It seems even the redirect requires SSL to work properly, but I thought Caddy handled that automatically? I’ve even imported the same (snippet) that I use for all other site blocks:
tls {
dns cloudflare [redacted]
resolvers 1.1.1.1
#strict_sni_host on
}
And it seems that Caddy is indeed generating a certificate for the www subsubdomain, according to the logs:
{"level":"debug","ts":1721400165.0851521,"logger":"tls.cache","msg":"added certificate to cache","subjects":["www.blog.domain.com"],"expiration":1726868801,"managed":true,
"issuer_key":"acme-v02.api.letsencrypt.org-directory","hash":"6b3c31936a7d9fc7d83d249afa0787af79b9615e8673afe81af862b37deb9c41","cache_size":15,"cache_capacity":10000}
{"level":"debug","ts":1721400165.085217,"logger":"events","msg":"event","name":"cached_managed_cert","id":"b8e18ab2-9e83-4a4a-8287-b7207d59cfb6","origin":"tls","data":{"sans":
["www.blog.domain.com"]}}
The fact that this exact example is used in the documentation as a common recipe tells me it should work, so I’m probably doing something wrong.