6

I'm trying to run two domains, one with a wildcard certificate and the other one with a regular certificate from one IP and one nginx.

Setup: example1.com with wildcard certificate example2.com with regular certificate

My current nginx config for my wildcard setup looks like this (I haven't started with adding the second domain yet):

/etc/nginx/sites-available/example1.com:

server {
    listen  443 default_server ssl;
    server_name         _;

    ssl_certificate     /etc/nginx/ssl/example1.com/example1.com.crt;
    ssl_certificate_key /etc/nginx/ssl/example1.com/example1.com.key;

    ssl_session_cache    shared:SSL:10m;
    ssl_session_timeout  10m;

    # Perfect Forward Security
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS +RC4 RC4";
}

server {
    listen      443;
    server_name example1.com;

    error_log   /var/log/nginx/example1.com.error.ssl.log;
    access_log  /var/log/nginx/example1.com.access.ssl.log;

    root /var/www/example1.com/;
    index index.html;
}

server {
    listen      80;
    server_name example1.com;
    rewrite     ^   https://$server_name$request_uri? permanent;
}

Now I also have some subdomains, that's why I'm using a wildcard certificate. The subdomain configs just looks like this:

/etc/nginx/sites-available/sub1.example1.com

server {
    listen      443;
    server_name sub1.example1.com;

    error_log   /var/log/nginx/sub1.example1.com.error.ssl.log;
    access_log  /var/log/nginx/sub1.example1.com.access.ssl.log;

    root /var/www/sub1.example1.com/;

    location / {
        # nothing
    }
}

server {
    listen      80;
    server_name sub1.example1.com;
    rewrite     ^   https://$server_name$request_uri? permanent;
}

This setup is pretty neat because all the subdomains are inheriting the ssl settings from the example.com config because it's the default_server.

What's the best way of adding a second domain now? If I just add the domain the same way I'll obviously get an error on launch because there's a duplicate default_server entry. If I remove the default_server entry from example2.com's config it'll fall back to the ssl config from example1.com.

What I want but don't know how to achieve:

Have one "main" config for each domain, let's call it example1.com-default and example2.com-default.

These configs should include all the settings that are common between the different subdomains, like the SSL config, Perfect Forward Security,... and the different subdomains would just be smaller configs who inherit these settings from their respective main domain.

So sub1.example1.com would inherit the SSL settings from example1.com-default and sub1.example2.com would inherit the SSL settings from example2.com-default.

Is this possible, and if it is how would I achieve this?

Thanks in advance!

3
  • 4
    I hope you know you will need SNI for this, which will exclude some old browsers and systems.
    – Zoredache
    Jun 14, 2014 at 20:55
  • what stops you from creating template config with includes???
    – ADM
    Jun 14, 2014 at 21:39
  • It should be possible to get one of the domains working for clients without SNI support, but the other domain will only work for clients with SNI support. One could also use IPv6 such that there will be no shortage of IP addresses. One does not rule out the other, so it will be possible to make both domains work for all clients which have either SNI or IPv6. Client which have neither SNI nor IPv6 support can expect to see inaccessible domains in the coming years.
    – kasperd
    Jun 14, 2014 at 22:19

2 Answers 2

4

If you are referring to other SSL settings than certificate / key, I would advice you to move their configuration to the http level in nginx configuration.

This way the settings will be inherited to every server block.

For example, in Debian and derivatives you can create /etc/nginx/conf.d/ssl.conf file, where you put these lines:

ssl_session_cache    shared:SSL:10m;
ssl_session_timeout  10m;

# Perfect Forward Security
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS +RC4 RC4";

The files inside conf.d are included in the http level.

default_server approach doesn't work here.

After this, the server blocks would look like this:

server {
    listen 443 default_server ssl;
    server_name _;

    ssl_certificate /path/to/certificate;
    ssl_certificate_key /path/to/key;
}

And, if you want to override some settings for some domains, then you can re-enter the directives in the server level.

-1

This is caused by SSL protocol behaviour. The SSL connection is established before the browser sends an HTTP request and nginx does not know the name of the requested server. Therefore, it may only offer the default server’s certificate.

You can read this article, at the end you have several options, using multiples domains in one server, many IPs as Certificates or SNI (Server_Name_Indication):

Configuring Https Servers, NGINX DOC

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .