Is it possible to have multiple sites with SSL on the same server pointing to different ports?

Question

I want to consolidate a couple sites I have to one server. I know that with nginx I can have a Node.js app running on a port and use nginx to make that port point to the domain name (or vice versa).

I want to know if it is possible to have each site in its own folder and/or running on different ports and have each site enabled with SSL, on nginx.

EDIT: Here's an example of what I did to get multiple sites working on the same server, with an A+ rating from SSL Labs.

##
# site A / 3001
##

server {
    listen 80;
    server_name domain.tld;

    location / {
        rewrite ^/(.*) https://$host$request_uri permanent;
    }
}

server {
    listen 443 ssl;
    server_name domain.tld;
    root /var/www/domain/public;

    index index.html;
    access_log off;

    add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
    ssl on;
    ssl_certificate /etc/letsencrypt/live/domain.tld/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/domain.tld/privkey.pem;
    ssl_session_timeout 5m;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA";
    ssl_prefer_server_ciphers on;
    ssl_dhparam /etc/letsencrypt/live/domain.tld/dhparams.pem;

    location / {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $http_host;
        proxy_set_header X-NginX-Proxy true;
        proxy_pass http://localhost:3001;
        proxy_redirect off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        proxy_redirect off;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_key sfs$request_uri$scheme;
    }

    location ~* ^.+\.(jpg|gif|png|ico|css|zip|tgz|gz|rar|bz2|pdf|txt|tar|wav|bmp|rtf|js|flv|swf|html)$ {
        expires 30d;
        root /var/www/domain;
    }
}



##
# site B / 3002
##

server {
    listen 80;
    server_name domain2.tld;

    location / {
        rewrite ^/(.*) https://$host$request_uri permanent;
    }
}

server {
    listen 443 ssl;
    server_name domain2.tld;
    root /var/www/domain2/public;

    index index.html;
    access_log off;

    add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
    ssl on;
    ssl_certificate /etc/letsencrypt/live/domain2.tld/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/domain2.tld/privkey.pem;
    ssl_session_timeout 5m;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA";
    ssl_prefer_server_ciphers on;
    ssl_dhparam /etc/letsencrypt/live/domain2.tld/dhparams.pem;

    location / {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $http_host;
        proxy_set_header X-NginX-Proxy true;
        proxy_pass http://localhost:3002;
        proxy_redirect off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        proxy_redirect off;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_key sfs$request_uri$scheme;
    }

    location ~* ^.+\.(jpg|gif|png|ico|css|zip|tgz|gz|rar|bz2|pdf|txt|tar|wav|bmp|rtf|js|flv|swf|html)$ {
        expires 30d;
        root /var/www/domain2/public;
    }
}

I hope this helps someone else, it took some trial and error getting this right.

Answer 1

Yes, nginx can do it.

You configure each site in its own virtual host with a server block, where you configure server_name and SSL certificate parameters. Then you use proxy_pass directive to make the request go to the backend for that particular site.

Each virtual host can have its own document root where the resources for that virtual host are served from.