Nginx listening to 443 in order to redirect a domain without an ssl certificate

Question

I got an ssl certificate for newdomain.org.il

But some requests (images) I'm getting from https://olddomain.org.il

(Since client has schemeless links, which is ok)

I can easily redirect non https requests:

server {
     listen      80;

     server_name  www.olddomain.org.il olddomain.org.il;
     return 301 https://newdomain.org.il$request_uri;
}

But that won't catch requests from old domain with https

but if I add a listen clause for olddomain

server {
     listen      80;
     listen      443 ssl;

     server_name  www.olddomain.org.il olddomain.org.il;
     return 301 https://newdomain.org.il$request_uri;
 }

requests would get an sslError since hostname won't match the certificate domain.

Any workaround this in nginx? (I know I can workaround and another ssl certificate for old domain or with a code change preventing those legacy urls to exists, but Since this is a migration process from a legacy app, I really don't want to.

Answer 1

Short answer, no.

The whole point of HTTPS is to ensure the security of the connection, you need to have a certificate for NGINX to load, and it has to be valid for the browsers to accept loading resources from it. The only way to keep the resources on the old domain and serve them over HTTPS is to add a valid certificate for the old domain.