← back to Domain Landings
ops: 443-cert remediation script + results (40 dead apex domains -> valid TLS)
4a719854d39792984127350a755c89e50c0d75f8 · 2026-08-17 17:51:13 -0700 · Steve
Files touched
A ops/443-remediation-20260817.txtA ops/fix443.sh
Diff
commit 4a719854d39792984127350a755c89e50c0d75f8
Author: Steve <steve@designerwallcoverings.com>
Date: Mon Aug 17 17:51:13 2026 -0700
ops: 443-cert remediation script + results (40 dead apex domains -> valid TLS)
---
ops/443-remediation-20260817.txt | 50 ++++++++++++++++++++++++++++++++++
ops/fix443.sh | 59 ++++++++++++++++++++++++++++++++++++++++
2 files changed, 109 insertions(+)
diff --git a/ops/443-remediation-20260817.txt b/ops/443-remediation-20260817.txt
new file mode 100644
index 0000000..99a88b6
--- /dev/null
+++ b/ops/443-remediation-20260817.txt
@@ -0,0 +1,50 @@
+# 443-cert remediation — 2026-08-17 17:51
+# ROOT CAUSE: 40 apex domains had a valid LE cert but a port-80-ONLY nginx vhost (half-finished certbot: certonly without installer). HTTPS fell to default_server -> wrong cert -> browser-blocked -> 'dead'.
+# FIX: appended a :443 server block (existing cert + proxy_pass to app) per domain; nginx -t gated; reload. Backups: /root/nginx-443fix-backup-*
+# RESULT (40 domains): 34x200 live, 4x401 auth-gated, 2x502 app-down. 0 cert-broken, 0 wrong-cert.
+#
+# STILL OPEN:
+# need cert issuance (2): abramsatlas.com abramsintel.com
+# need vhost from scratch (10, several parked/activist): bleachfriendly freethedegree joshdultz nataliaabrams nationalvotingday petitionyour protestdaily steveabramsdesigns studentstrikes venturacorridor
+# TLS fixed but app down (2): etciemurals.com (LIKELY INTENTIONAL - Et Cie rights revoked/archived; do NOT resurrect), commercialsalesreps.com
+
+asseeninhotels.com|200|CN=asseeninhotels.com|ok
+asseeninla.com|200|CN=asseeninla.com|ok
+asseeninmovies.com|200|CN=asseeninmovies.com|ok
+asseeninshowrooms.com|200|CN=asseeninshowrooms.com|ok
+barwallpaper.com|200|CN=barwallpaper.com|ok
+blankstocklining.com|200|CN=blankstocklining.com|ok
+carmelwallpaper.com|200|CN=carmelwallpaper.com|ok
+cfafabrics.com|200|CN=cfafabrics.com|ok
+classawallcovering.com|200|CN=classawallcovering.com|ok
+designermagnetics.com|200|CN=designermagnetics.com|ok
+fabricfridays.com|200|CN=fabricfridays.com|ok
+flocked.org|200|CN=flocked.org|ok
+grassclothwallcovering.com|200|CN=grassclothwallcovering.com|ok
+handmadewallcovering.com|200|CN=handmadewallcovering.com|ok
+hospitalitysalesagency.com|200|CN=hospitalitysalesagency.com|ok
+malibuwallpaper.com|200|CN=malibuwallpaper.com|ok
+montereywallpaper.com|200|CN=montereywallpaper.com|ok
+naturalwalltextures.com|200|CN=naturalwalltextures.com|ok
+philliperomano.com|200|CN=philliperomano.com|ok
+printmurals.com|200|CN=printmurals.com|ok
+restaurantfabrics.com|200|CN=restaurantfabrics.com|ok
+restaurantmurals.com|200|CN=restaurantmurals.com|ok
+roomsettings.com|200|CN=roomsettings.com|ok
+sheltermagazines.com|200|CN=sheltermagazines.com|ok
+thehotelwallpaper.com|200|CN=thehotelwallpaper.com|ok
+traditionalwhimsy.com|200|CN=traditionalwhimsy.com|ok
+unitedstateswallpaper.com|200|CN=unitedstateswallpaper.com|ok
+wallcovering.net|200|CN=wallcovering.net|ok
+wallpaperexports.com|200|CN=wallpaperexports.com|ok
+wallpaperfromthe80s.com|200|CN=wallpaperfromthe80s.com|ok
+wallpaperny.com|200|CN=wallpaperny.com|ok
+wallpaperpurchasing.com|200|CN=wallpaperpurchasing.com|ok
+wallpaperweekly.com|200|CN=wallpaperweekly.com|ok
+wc01wallcoverings.com|200|CN=wc01wallcoverings.com|ok
+1800wallcoverings.com|401|CN=1800wallcoverings.com|ok
+fireratedwallcovering.com|401|CN=fireratedwallcovering.com|ok
+specifywallpaper.com|401|CN=specifywallpaper.com|ok
+stevenabramsphotography.com|401|CN=stevenabramsphotography.com|ok
+commercialsalesreps.com|502|CN=commercialsalesreps.com|ok
+etciemurals.com|502|CN=etciemurals.com|ok
diff --git a/ops/fix443.sh b/ops/fix443.sh
new file mode 100644
index 0000000..c77ff3d
--- /dev/null
+++ b/ops/fix443.sh
@@ -0,0 +1,59 @@
+#!/bin/bash
+# Add a :443 server block (reusing the domain's existing LE cert) to any dead vhost that is port-80-only.
+# MODE: dry (default) = report only; apply = write + nginx -t + reload.
+MODE="${1:-dry}"
+SA=/etc/nginx/sites-available
+TS=$(date +%Y%m%d-%H%M%S)
+BK=/root/nginx-443fix-backup-$TS
+mkdir -p "$BK"
+fixed=0; skip_nocert=0; skip_has443=0; skip_novhost=0; nocert_list=""; novhost_list=""
+while read d; do
+ [ -z "$d" ] && continue
+ conf="$SA/$d.conf"
+ [ -f "$conf" ] || conf=$(grep -rlE "server_name[^;]*\b${d//./\\.}\b" "$SA"/ 2>/dev/null | grep -v typo-redirect | head -1)
+ if [ -z "$conf" ] || [ ! -f "$conf" ]; then skip_novhost=$((skip_novhost+1)); novhost_list="$novhost_list $d"; continue; fi
+ # already has a 443 listener?
+ if grep -qE 'listen[^;]*443' "$conf"; then skip_has443=$((skip_has443+1)); continue; fi
+ # cert present?
+ if [ ! -s "/etc/letsencrypt/live/$d/fullchain.pem" ]; then skip_nocert=$((skip_nocert+1)); nocert_list="$nocert_list $d"; continue; fi
+ # extract upstream + server_name from the existing :80 block
+ upstream=$(grep -oE 'proxy_pass\s+http://[^;]+' "$conf" | head -1 | awk '{print $2}')
+ snames=$(grep -m1 -E '^\s*server_name' "$conf" | sed -E 's/^\s*server_name\s+//; s/;.*//')
+ [ -z "$upstream" ] && { echo " ! $d: no proxy_pass found, skipping"; continue; }
+ block=$(cat <<EOF
+
+# --- 443 added by fix443.sh $TS ---
+server {
+ listen 45.61.58.125:443 ssl http2;
+ server_name $snames;
+ ssl_certificate /etc/letsencrypt/live/$d/fullchain.pem;
+ ssl_certificate_key /etc/letsencrypt/live/$d/privkey.pem;
+ include /etc/letsencrypt/options-ssl-nginx.conf;
+ ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+ add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+ location / {
+ proxy_pass $upstream;
+ proxy_http_version 1.1;
+ proxy_set_header Host \$host;
+ proxy_set_header X-Real-IP \$remote_addr;
+ proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+ proxy_set_header X-Forwarded-Proto \$scheme;
+ }
+}
+EOF
+)
+ echo " ✓ $d -> 443 block (upstream $upstream, names: $snames)"
+ if [ "$MODE" = apply ]; then
+ cp "$conf" "$BK/$(basename "$conf")"
+ printf '%s\n' "$block" >> "$conf"
+ fi
+ fixed=$((fixed+1))
+done < "${LIST:-/tmp/dead52.txt}"
+echo
+echo "SUMMARY: would-fix=$fixed | skip(has443)=$skip_has443 | skip(no-cert)=$skip_nocert | skip(no-vhost)=$skip_novhost"
+[ -n "$nocert_list" ] && echo "NEED CERT ISSUANCE:$nocert_list"
+[ -n "$novhost_list" ] && echo "NEED VHOST FROM SCRATCH:$novhost_list"
+if [ "$MODE" = apply ]; then
+ echo; echo "=== nginx -t after changes ==="
+ if nginx -t 2>&1 | tail -3; then echo "backups in $BK"; else echo "!! nginx -t FAILED — NOT reloading. restore: cp $BK/* $SA/"; fi
+fi
← 3ca6313 wall: host-scope admin surface to wall.agentabrams.com only
·
back to Domain Landings
·
GA4: wire dsgntv.com property G-V5JTVMGNBN into landing conf 2dd730e →