# Demo sites not available?
**URL:** https://discuss.tryton.org/t/demo-sites-not-available/2243
**Category:** Site Feedback
**Created:** [January 27, 2020, 11:58am UTC](https://discuss.tryton.org/t/demo-sites-not-available/2243 "2020-01-27T11:58:28Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@dave](https://discuss.tryton.org/u/dave)
#### Post date: [January 27, 2020, 11:58am UTC](https://discuss.tryton.org/t/demo-sites-not-available/2243/1 "2020-01-27T11:58:28Z")
I have just tried to go onto the Tryton demo sites, and my browser is complaining that the certificates are not valid.
The DNS names for the demo sites don’t appear to be in the Subject Alt Names list.
---
### Author:  [@ced](https://discuss.tryton.org/u/ced)
#### Post date: [January 27, 2020, 12:16pm UTC](https://discuss.tryton.org/t/demo-sites-not-available/2243/2 "2020-01-27T12:16:44Z")
All demo\*.tryton.org are plain HTTP. We do not manage to create a new certificate for each new version.
Despite [demo.tryton.org](http://demo.tryton.org) not being setup in nginx to listen on 443, nginx still seems to serve it as if it was [tryton.org](http://tryton.org).
---
### Author:  [@ced](https://discuss.tryton.org/u/ced)
#### Post date: [January 27, 2020, 12:21pm UTC](https://discuss.tryton.org/t/demo-sites-not-available/2243/3 "2020-01-27T12:21:11Z")
> [@ced](#):
>
> Despite [demo.tryton.org](http://demo.tryton.org) not being setup in nginx to listen on 443, nginx still seems to serve it as if it was [tryton.org](http://tryton.org).
It is explained in [Server names](http://nginx.org/en/docs/http/server_names.html#miscellaneous_names)
So it is using the default [tryton.org](http://tryton.org) which has ssl.
Any way, there is nothing more we can do here.
---
### Author:  [@dave](https://discuss.tryton.org/u/dave)
#### Post date: [January 27, 2020, 12:28pm UTC](https://discuss.tryton.org/t/demo-sites-not-available/2243/4 "2020-01-27T12:28:34Z")
> [@ced](#):
>
> Any way, there is nothing more we can do here.
No, that’s fine.
I must have automatically typed `https` in when entering in the url, not realizing that they were `http` only. Thanks.
---
### Author:  [@pokoli](https://discuss.tryton.org/u/pokoli)
#### Post date: [January 27, 2020, 12:33pm UTC](https://discuss.tryton.org/t/demo-sites-not-available/2243/5 "2020-01-27T12:33:55Z")
> [@ced](#):
>
> All demo\*.tryton.org are plain HTTP. We do not manage to create a new certificate for each new version.
Maybe we can requests a [wildcard certificate](https://letsencrypt.org/2017/07/06/wildcard-certificates-coming-jan-2018.html) so we can use it for the demo sites.
This will improve the image of the demo sites as they will be also server by https.
---
### Author:  [@ced](https://discuss.tryton.org/u/ced)
#### Post date: [January 27, 2020, 1:44pm UTC](https://discuss.tryton.org/t/demo-sites-not-available/2243/6 "2020-01-27T13:44:30Z")
wildcard certificate requires a validation via DNS. But as far as I can tell, there is no plugin to automate them with [nsd](https://nlnetlabs.nl/projects/nsd/).
---
### Author:  [@ced](https://discuss.tryton.org/u/ced)
#### Post date: [January 27, 2020, 1:48pm UTC](https://discuss.tryton.org/t/demo-sites-not-available/2243/7 "2020-01-27T13:48:59Z")
Maybe it is doable with [certbot-dns-rfc2136](https://certbot-dns-rfc2136.readthedocs.io/en/stable/) but it is not yet packaged in Gentoo.
---
### Author:  [@ced](https://discuss.tryton.org/u/ced)
#### Post date: [February 1, 2020, 4:51pm UTC](https://discuss.tryton.org/t/demo-sites-not-available/2243/8 "2020-02-01T16:51:35Z")
I successfully manage to get a wildcard certificate for `tryton.org` by using hooks. Here are for the record.
### manual auth hook
```bash
#!/bin/bash
set -e
PATH="/var/lib/nsd"
DOMAIN=$(/usr/bin/expr match "$CERTBOT_DOMAIN" '.*\.\(.*\..*\)') || :
if [-z "${DOMAIN}"]; then
DOMAIN=${CERTBOT_DOMAIN}
fi
ZONE="${PATH}/${DOMAIN}.zone"
INC="${PATH}/${CERTBOT_DOMAIN}.zone.acme.inc"
echo "_acme-challenge.${CERTBOT_DOMAIN}. 5 IN TXT \"${CERTBOT_VALIDATION}\"" > "${INC}"
/bin/sed -i -r 's/(.*)([0-9]{10})( ; serial.*)/echo "\1$((\2+1))\3"/ge' "${ZONE}"
/usr/sbin/nsd-control reload "${DOMAIN}" >/dev/null
/usr/sbin/nsd-control notify "${DOMAIN}" >/dev/null
/usr/bin/sleep 5
```
### manual cleanup hook
```bash
#!/bin/bash
set -e
PATH="/var/lib/nsd"
DOMAIN=$(/usr/bin/expr match "$CERTBOT_DOMAIN" '.*\.\(.*\..*\)') || :
if [-z "${DOMAIN}"]; then
DOMAIN=${CERTBOT_DOMAIN}
fi
ZONE="${PATH}/${DOMAIN}.zone"
INC="${PATH}/${CERTBOT_DOMAIN}.zone.acme.inc"
echo "" > "${INC}"
/bin/sed -i -r 's/(.*)([0-9]{10})( ; serial.*)/echo "\1$((\2+1))\3"/ge' "${ZONE}"
/usr/sbin/nsd-control reload "${DOMAIN}" >/dev/null
/usr/sbin/nsd-control notify "${DOMAIN}" >/dev/null
```
and with [RFC 1035 $INCLUDE](https://www.ietf.org/rfc/rfc1035) directive.
As demo are subdomain, I had to add all wildcard domain for 0, 2, 4, 6 and 8 subdomain.
So I changed website: [https://hg.tryton.org/www.tryton.org/rev/ff776620490b](https://hg.tryton.org/www.tryton.org/rev/ff776620490b)