From 335c0fea615b83eb85b310043257deda7b09688d Mon Sep 17 00:00:00 2001 From: isaacclad Date: Mon, 13 Jul 2026 17:18:27 +0000 Subject: [PATCH] Do not request www aliases when issuing SSL for subdomain sites. Certbot was including www.data.example.com for managed DNS subdomains, which NXDOMAIN and failed the whole certificate. Co-authored-by: Cursor --- .../Hosting/Providers/SharedNodeProvider.php | 24 ++++++++++++------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/app/Services/Hosting/Providers/SharedNodeProvider.php b/app/Services/Hosting/Providers/SharedNodeProvider.php index 2cceaf8..e18419f 100644 --- a/app/Services/Hosting/Providers/SharedNodeProvider.php +++ b/app/Services/Hosting/Providers/SharedNodeProvider.php @@ -1032,22 +1032,28 @@ NGINX; ]); } - // Build domain list - include www if we manage DNS or if it resolves + // Build domain list — include www only for apex sites when it exists. + // Subdomains like data.example.com must not request www.data.example.com + // (NXDOMAIN), or the whole certificate fails. $domainArgs = ' -d ' . escapeshellarg($domain); $wwwDomain = "www.{$domain}"; $domainModel = $site->domain_id ? $site->domain()->first() : null; - $dnsIsManaged = $domainModel && $domainModel->dns_mode === 'managed'; - - if ($dnsIsManaged) { - // We manage DNS, so www record exists - always include it + $dnsIsManaged = $domainModel && ( + (string) $domainModel->dns_mode === 'managed' + || (method_exists($domainModel, 'usesManagedDns') && $domainModel->usesManagedDns()) + ); + $isSubdomainSite = ($site->type === 'subdomain') || str_starts_with(strtolower((string) $site->type), 'sub'); + + if ($isSubdomainSite) { + Log::info('SSL: Skipping www alias for subdomain site', ['domain' => $domain]); + } elseif ($dnsIsManaged) { $domainArgs .= ' -d ' . escapeshellarg($wwwDomain); - Log::info("SSL: Including www subdomain (managed DNS)", ['domain' => $domain, 'www' => $wwwDomain]); + Log::info('SSL: Including www subdomain (managed DNS)', ['domain' => $domain, 'www' => $wwwDomain]); } elseif ($this->domainResolvesToServer($wwwDomain)) { - // Manual DNS - only include www if it resolves $domainArgs .= ' -d ' . escapeshellarg($wwwDomain); - Log::info("SSL: Including www subdomain (resolves)", ['domain' => $domain, 'www' => $wwwDomain]); + Log::info('SSL: Including www subdomain (resolves)', ['domain' => $domain, 'www' => $wwwDomain]); } else { - Log::info("SSL: Skipping www subdomain (manual DNS, does not resolve)", ['domain' => $domain, 'www' => $wwwDomain]); + Log::info('SSL: Skipping www subdomain (manual DNS, does not resolve)', ['domain' => $domain, 'www' => $wwwDomain]); } $result = $this->runLocalAdminOperationOrRemote(