Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In my configuration I have placed the ssl_* directives inside the http block and have been using a wildcard certificate certified by a custom CA without any problems. However, I now want to use a new certificate for a new subdomain (a server), that has been certified by a recognized CA.

Let's say the TLD is I want my custom certificate with CN * to be used on all domains except for that will use its own certificate/key pair of files with CN

How would one do that? Adding new ssl_* directives inside the server block doesn't seem to override the global settings.

share|improve this question
up vote 1 down vote accepted

In my experience, settings in server stanzas do override those set in the surrounding http stanza, although I must admit I've never tried to set SSL parameters (given that you usually only have SSL config in your SSL vhosts).

You might want to describe exactly why you think it isn't working, and provide debug logs and your config files so the cause of your dilemma can be identified.

share|improve this answer
It might have to do with the fact that the default ssl certificate in the http block is a wildcard one. Unfortunately, I've been googling with no results and there's no errors in the logs. – alkar Apr 1 '12 at 9:12
No, nginx doesn't care what's in your certificates. I'm not asking for logs to look for errors, I'm interested in the debug information. – womble Apr 1 '12 at 9:14
For some strange reason nginx restart script failed to restart the process yet it did report as though nginx was successfully restarted. After a bit of looking through logs, I realized that and manually did a restart and it worked sucessfully. So nginx ssl_* directives are overriding as expected. – alkar Apr 1 '12 at 10:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.