Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to setup a server that will server same content over SSL using different domain names. The problem is that I need an ability to add new domain names as easily as possible. Assuming that all domain names are already configured to my server I guess whether it is possible to setup nginx (or maybe another reverse-proxy) in a way so it will listen all requests to a particular IP and after obtaining a HTTPS request try to lookup a certificate for domain that was used to make this request in some folder or DB and serve the request if certificate was found (so we can establish secure connection), or reject the connection if certificate wasn't found.

I'm not sure that it is possible at all or maybe I'm thinking about something reckless but since I wasn't able to find any info on the net I've decided to ask here.

As I understand the most simple solution for this will be to add a separate configuration for each domain that should be supported.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

I guess there is no other solution than creating a separate config for each vhost. Using templates that should be quite simple.

However, SNI is not yet supported by some browsers (all recent browsers do). These browsers might show an invalid certificate message.

If you want to reject connections for some vhosts without certificate you should simply not enable ssl on these vhosts. Add a default server that catches all connections for unknown vhosts on the ssl port and return an error (403 forbiden or non standard 444 for tcp reset):

server {
    listen 433 default_server ssl;
    ssl_certificate       common.crt;
    ssl_certificate_key   common.key;
    return 403;
}

You can not prevent the invalid certificate message on vhosts without ssl, as it is not possible to cancel the tcp connection before the ssl handshake using nginx. You might try iptables to reject non sni ssl handshakes but that might be a bit tricky to configure correctly and will probably require some knowledge of ssl specifications.

share|improve this answer
    
last I looked, browsers that don't support SNI still make up about 15% of web traffic. –  Chris S Feb 11 at 15:23
    
These 15% are probably the last Windows XP clients that have not updated yet. All recent browsers on other platforms support SNI, (check the results form ssllabs.com). –  xblax Feb 11 at 15:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.