Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an Nginx instance using SNI to serve multiple HTTPS domains from a single IP.

The only glitch with the setup is that Nginx responds with the first (acting as default) domain whenever a URL for the bare IP of the server, or a domain listed at that IP for which there is no corresponding HTTPS server block, is requested. In this case I would much prefer to simply return a standard 403 Forbidden -- I would set up a default server block to do this but I can't see a way around client certificate mismatch warnings.

(How c|C)an I configure Nginx to reject requests to such unknown/undefined domains without needing to specify a particular ssl certificate which will upset browsers? (i.e. I need Nginx to reject the request with a 403 prior to upsetting the client with a "bad" cert - from the client's POV this should be identical to the case where no HTTPS server block is defined at all.)

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

This Question quite similar to the one I answered yesterday: nginx and SNI: is it possible to automatically resolve SSL certificate by domain name

It is not possible to reject the connection before the user sees a bad certificate message in his browser. By the time Nginx might return an HTTP 403 answer, the SSL handshake is over and to complete the handshake the browser must accept the provided certificate. You can only reject the connection after the user accepted the certificate by setting up a default server:

server {
    listen 433 default_server ssl;
    ssl_certificate       common.crt;
    ssl_certificate_key   common.key;
    return 403;
}

However, most recent browsers support Server Name Indication and if you have a certificate set for each vhost, it's quite unlikely for a normal user to see that message.

It might be possible to reject connections without valid hostname indicated by SSL with iptables but that is probably quite tricky and would not be conform to any standards at all.

share|improve this answer
    
Thanks for the answer. I think you've about covered it. –  Carlton Gibson Feb 12 at 20:11
add comment

If your domains are subdomains of the same master (*.example.com) you could use a wildcard certificate. Failing that, I don't think you can supply any cert the browser will be happy with.

share|improve this answer
    
Hi Chris. I appreciate the wildcard point but it's not really what I'm asking. Yes, the browser isn't going to like any cert BUT is there any way of rejecting the connection based on the requested server name? (I'm suspecting not, but this seems the place to ask... :) –  Carlton Gibson Jan 23 '11 at 9:44
    
Untested assumption -> You'll need to supply a valid cert or the browser will consider the connection unsafe. The browser will therefore not act on any redirect you send it until the user allows an override. The only way I can think of to automatically perform the override is to provide a valid cert. :-( –  Chris Nava Jan 24 '11 at 4:23
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.