Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have two hostnames sharing the same domain name which I want to serve over HTTPs. I've got a wildcard-SSL certificate and created two vhost configs:

Host A

listen      127.0.0.1:443 ssl;
server_name     a.example.com;
root        /data/httpd/a.example.com;
ssl_certificate /etc/ssl/wildcard.cer;
ssl_certificate_key /etc/ssl/wildcard.key;

Host B

listen      127.0.0.1:443 ssl;
server_name     b.example.com;
root        /data/httpd/b.example.com;
ssl_certificate /etc/ssl/wildcard.cer;
ssl_certificate_key /etc/ssl/wildcard.key;

However, I get the same vhost served for either hostname.

share|improve this question
add comment

3 Answers 3

up vote 4 down vote accepted

You need to split vhosts from ssl listening/configuration part:

Listening part:

server {
  listen              127.0.0.1:443 default_server ssl;
  server_name         _;
  ssl_certificate     /etc/ssl/wildcard.cer;
  ssl_certificate_key /etc/ssl/wildcard.key;
}

And now vhosts:

server {
  listen      127.0.0.1:443;
  server_name a.example.com;
  root        /data/httpd/a.example.com;
}

server {
  listen      127.0.0.1:443;
  server_name b.example.com;
  root        /data/httpd/b.example.com;
}
share|improve this answer
    
This wouldn't work. A vhost needs ssl_certificate and ssl_certificate_key that should be configured inside server or http location. In your example, you have declared it inside the first server location, but didn't declare it for the other two vhosts. –  Pothi Oct 27 '13 at 15:06
    
it's enough to configure ssl_certificate, ssl_certificate_key and ssl on default_server only. BTW, this config actually works. –  Teftin Oct 27 '13 at 15:49
    
Unfortunately this doesn't work: nginx serves the same vhost content on both hosts. –  vvanscherpenseel Oct 28 '13 at 12:11
    
Apparently you need to restart nginx instead of reloading it when doing these changes. Many thanks, your answer works like a charm :) –  vvanscherpenseel Oct 28 '13 at 17:29
add comment

You need SNI support on both sides: client and server. See here for details: http://nginx.org/en/docs/http/configuring_https_servers.html#sni

share|improve this answer
add comment

It's actually explained in the manual: http://nginx.org/en/docs/http/configuring_https_servers.html#certificate_with_several_names

ssl_certificate /etc/ssl/wildcard.cer;
ssl_certificate_key /etc/ssl/wildcard.key;
server {
  listen      443 ssl;
  server_name a.example.com;
  root        /data/httpd/a.example.com;
}
server {
  listen      443 ssl;
  server_name b.example.com;
  root        /data/httpd/b.example.com;
}

Now, if you have many sites, I suggest storing all of them in a folder with just the server{} part as above in single files, and an include directive in the main file to load all of them:

ssl_certificate /etc/ssl/wildcard.cer;
ssl_certificate_key /etc/ssl/wildcard.key;
include /etc/nginx/conf.d/subfolder/*;
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.