up vote 1 down vote favorite
share [g+] share [fb]

I have an Nginx instance using SNI to serve multiple HTTPS domains from a single IP.

The only glitch with the setup is that Nginx responds with the first (acting as default) domain whenever a URL for the bare IP of the server, or a domain listed at that IP for which there is no corresponding HTTPS server block, is requested. In this case I would much prefer to simply return a standard 403 Forbidden -- I would set up a default server block to do this but I can't see a way around client certificate mismatch warnings.

(How c|C)an I configure Nginx to reject requests to such unknown/undefined domains without needing to specify a particular ssl certificate which will upset browsers? (i.e. I need Nginx to reject the request with a 403 prior to upsetting the client with a "bad" cert - from the client's POV this should be identical to the case where no HTTPS server block is defined at all.)

link|improve this question
feedback

1 Answer

up vote 0 down vote

If your domains are subdomains of the same master (*.example.com) you could use a wildcard certificate. Failing that, I don't think you can supply any cert the browser will be happy with.

link|improve this answer
Hi Chris. I appreciate the wildcard point but it's not really what I'm asking. Yes, the browser isn't going to like any cert BUT is there any way of rejecting the connection based on the requested server name? (I'm suspecting not, but this seems the place to ask... :) – Carlton Gibson Jan 23 '11 at 9:44
Untested assumption -> You'll need to supply a valid cert or the browser will consider the connection unsafe. The browser will therefore not act on any redirect you send it until the user allows an override. The only way I can think of to automatically perform the override is to provide a valid cert. :-( – Chris Nava Jan 24 '11 at 4:23
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.