nginx and SNI: is it possible to automatically resolve SSL certificate by domain name

Question

I need to setup a server that will server same content over SSL using different domain names. The problem is that I need an ability to add new domain names as easily as possible. Assuming that all domain names are already configured to my server I guess whether it is possible to setup nginx (or maybe another reverse-proxy) in a way so it will listen all requests to a particular IP and after obtaining a HTTPS request try to lookup a certificate for domain that was used to make this request in some folder or DB and serve the request if certificate was found (so we can establish secure connection), or reject the connection if certificate wasn't found.

I'm not sure that it is possible at all or maybe I'm thinking about something reckless but since I wasn't able to find any info on the net I've decided to ask here.

As I understand the most simple solution for this will be to add a separate configuration for each domain that should be supported.

Answer 1

I guess there is no other solution than creating a separate config for each vhost. Using templates that should be quite simple.

However, SNI is not yet supported by some browsers (all recent browsers do). These browsers might show an invalid certificate message.

If you want to reject connections for some vhosts without certificate you should simply not enable ssl on these vhosts. Add a default server that catches all connections for unknown vhosts on the ssl port and return an error (403 forbiden or non standard 444 for tcp reset):

server {
    listen 433 default_server ssl;
    ssl_certificate       common.crt;
    ssl_certificate_key   common.key;
    return 403;
}

You can not prevent the invalid certificate message on vhosts without ssl, as it is not possible to cancel the tcp connection before the ssl handshake using nginx. You might try iptables to reject non sni ssl handshakes but that might be a bit tricky to configure correctly and will probably require some knowledge of ssl specifications.