add golive-ssl-diag.sh: read-only probe of why agency :443 serves default cert

ca84584dd7aa01a4f161743a38f3cac5a939bea3 · 2026-08-13 13:41:29 -0700 · Steve Abrams

Files touched

A golive-ssl-diag.sh

Diff

commit ca84584dd7aa01a4f161743a38f3cac5a939bea3
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Aug 13 13:41:29 2026 -0700

    add golive-ssl-diag.sh: read-only probe of why agency :443 serves default cert
---
 golive-ssl-diag.sh | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/golive-ssl-diag.sh b/golive-ssl-diag.sh
new file mode 100644
index 0000000..82e9701
--- /dev/null
+++ b/golive-ssl-diag.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# READ-ONLY diagnostic: why does agency.agentabrams.com :443 serve the default cert?
+# Run from Mac2:  bash ~/Projects/abramsagency/golive-ssl-diag.sh
+set -euo pipefail
+SRV=root@45.61.58.125
+ssh -o StrictHostKeyChecking=accept-new "$SRV" 'bash -s' <<'EOS'
+echo "== conf.d files mentioning agency =="; grep -rl agency.agentabrams.com /etc/nginx/ 2>/dev/null
+echo "== loaded server blocks for agency (from nginx -T) =="; nginx -T 2>/dev/null | grep -nE "server_name agency.agentabrams.com|listen .*443|ssl_certificate .*agency" | grep -iA0 -B0 agency -n || true
+echo "== full agency block(s) in running config =="; nginx -T 2>/dev/null | awk '/server_name[[:space:]]+agency.agentabrams.com/{p=1} p{print} p&&/}/{c++; if(c>0){p=0;c=0;print "----"}}' | head -60
+echo "== is there a 443 default_server? =="; nginx -T 2>/dev/null | grep -nE "listen[[:space:]]+443.*default_server" | head
+echo "== cert files present? =="; ls -la /etc/letsencrypt/live/agency.agentabrams.com/ 2>/dev/null || echo "NO cert dir"
+EOS

← c1a6837 golive-ssl-fix: raise server_names_hash_MAX_SIZE to 8192 (re · back to Abramsagency · add restart-nginx.sh: clean restart to rebuild server_names_ ad0e29d →