Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an nginx server running with two IP addresses, say 1.2.3.4 and 4.3.2.1. Besides there are two wildcard SSL certificates for *.example.net (i.e. wc1, pointing to 1.2.3.4) and *.sub.example.net (i.e. wc2, pointing to 4.3.2.1).

The nginx docs mention that you can share a wildcard certificate between server instances like this:

ssl_certificate      wc1.crt;
ssl_certificate_key  wc1.key;

server {
    listen           1.2.3.4:443;
    server_name      www.example.net;
    ssl              on;
    ...
}

server {
    listen           1.2.3.4:443;
    server_name      test.example.net;
    ssl              on;
    ...
}

However, I was wondering whether this same construct is possible to use with the second wildcard certificate too. Both domains have around 500 subdomains.

Do they not get mixed up, since the ssl_certificate construct is now global?

share|improve this question
add comment

2 Answers

up vote 0 down vote accepted

Try this:

server {
    listen           1.2.3.4:443 default_server ssl;
    server_name      _;
    ssl_certificate      wc1.crt;
    ssl_certificate_key  wc1.key;
}

server {
    listen           4.3.2.1:443 default_server ssl;
    server_name      _;
    ssl_certificate      wc2.crt;
    ssl_certificate_key  wc2.key;
}

server {
    listen           1.2.3.4:443 ssl;
    server_name      www.example.net;
    ...
}

server {
    listen           1.2.3.4:443 ssl;
    server_name      test.example.net;
    ...
}

server {
    listen           4.3.2.1:443 ssl;
    server_name      www.sub.example.net;
    ...
}

server {
    listen           4.3.2.1:443 ssl;
    server_name      test.sub.example.net;
    ...
}

I can affirm that this method definitely works with one wildcard certificate, so here's hoping it works with two or more.

Credit: http://serverfault.com/a/548942/185775

share|improve this answer
add comment

The ssl_certificate directive can either be used at the http block level (in which case it applies to all server blocks), or the server level (in which case it only applies to that specific server block). If you want to use different certificates just define the ssl_certificate inside the appropriate server block.

share|improve this answer
    
I only have two certificates, but each certificate is used around 500 times in a subdomain. That's why I wanted to share the memory of the certificate footprint along these 500 subdomains. –  hvtilborg Aug 2 '12 at 7:53
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.