Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a wildcard SSL certificate and several subdomains on the same ip. Now I want my nginx to handle only mentioned server names and drop connection for others so that it'd look like nginx is not running for unlisted server names (not responding, rejecting, dead, not a single byte in response). I do the following

ssl_certificate         tls/domain.crt;
ssl_certificate_key     tls/domain.key;

server {
  listen 1.2.3.4:443 ssl;
  server_name validname.domain.com;
  //
}

server {
  listen 1.2.3.4:443 ssl;
  server_name _;
  // deny all;
  // return 444;
  // return 404;
  //location {
  //  deny all;
  //}
}

I've tried almost everything in the last server block, but no success. I get either valid response from known virtual server or error code. Please help.

share|improve this question
add comment

3 Answers

up vote 2 down vote accepted

It doesn't work that way: the SSL handshake happens before HTTP, so the name on the certificate will get evaluated in the browser before you can redirect or do anything else inside the nginx configuration.

share|improve this answer
    
this is bad, but have to admit) Thanks. –  Osw Mar 27 '12 at 14:08
    
This is not true: you can do something else at lower level, like dropping connection without any response, as explained in other answers. –  collimarco Mar 19 at 15:19
add comment

I implemented the above solution today, and it worked swimmingly. All URL's not specified are dropped, now. Placing this server code before the actual virtual server entry was key - all mal-formed URL's now go to this 'default' server.

... 
server {
     listen       443;
     server_name    _;
     return 444; }

server {
     listen       443;
     server_name  [URL]
share|improve this answer
add comment

You should be able to handle this by making the server that handles the unlisted items the first server block in your config.

http {
    ...

    server {
        listen 80;
        listen 443 ssl;
        return 444;
    }

    server {
        server_name validname.domain.com;
        ...
    }
}

All domains not specifically identified will be handled by this server block.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.