Why does secondary subdomain for Discourse in AWS fail?

Question

I have a domain for a public-facing static website that loads fine whether it’s entered into the browser as example.com, http://example.com, or https://example.com.

I have a private (accessible by login) subdomain for a Discourse forum that loads fine whether it’s entered into the browser as discourse.example.com, http://discourse.example.com, or https://discourse.example.com.

The subdomain for Discourse is achieved by addition of a record to the AWS Route 53 hosted zone:

Record name: discourse.example.com

Record type: A

Value: 123.45.678.90

Alias: No

TTL: 300

Routing policy: Simple

I’d like to provide a shorter alternative/secondary subdomain for Discourse. So I added another record, nearly same as the prior, only with the record name changed from discourse.example.com to d.example.com.

Strangely, this works in HTTP, but in HTTPS the browser warns:

Your connection is not private

Attackers might be trying to steal your information from d.example.com (for example, passwords, messages, or credit cards).

Learn more

NET::ERR_CERT_COMMON_NAME_INVALID

What am I missing? Should I be going about this a different way?

My AWS Certificate covers example.com and *.example.com. My CloudFront distribution covers example.com and d.example.com. I have disabled my Amazon CloudFront cache during this configuration temporarily to ensure that’s not a factor.

Answer 1

I found a solution:

• Go to AWS S3 and create a new bucket.
• Name it my desired subdomain (d.example.com).
• Make it public.
• Enable static web hosting.
• Set hosting type to Redirect.
• Set host name to desired redirect URL (discourse.example.com).
• Note its static website hosting bucket website endpoint for later (looks like http://d.example.com.s3-website.aws-region-2.amazonaws.com).
• Go to CloudFront and create a new distribution.
• Paste the noted endpoint into the origin domain (do not choose the similar but slightly different option from the dropdown).
• Add alternate/CNAME as desired new subdomain (d.example.com).
• Choose existing AWS certificate for SSL.
• Go to Route 53, choose the existing hosted zone, and create a new record.
• Leave type as A record.
• Set record name to desired subdomain (d).
• Change value to Alias.
• Route traffic to CloudFront.
• Choose the new distribution from the dropdown.
• Wait a few minutes before attempting to load the new subdomain in the browser.