1

Our company sets up and maintains many WordPress networks, some of them approach 100 websites.

We developped a wp-cli script using let's encrypt that generates a SAN SSL certificate containing all domains of the WordPress network, and we set up this SAN certificate in the server block of our nginx configuration using ssl_certificate so that all websites can use HTTPS.

Currently we have a single nginx vhost to handle the whole network, and this is quite practical so we don't have to create a new vhost each time we create a website.

The problem is Let's Encrypt limits SAN certificates to 100 domains so we soon won't be able to cover all websites.

The nginx documentation states that recent versions of nginx might in some case accept multiple ssl_certificate entries, but this seems to apply for certificates with different formats (RSA, SDA, etc.)

Here are my questions :

  • If I split my SAN into blocks of 100, will I be able to use multiple ssl_certificate entries in my single nginx vhost ? Do I have to upgrade to nginx 1.11 for that ? or else
  • Is there a simple solution to configure a limited number of vhosts (if possible not one per website) and share domains with a limited number of SAN certificates - if possible using only one IP address/cname ?

We could end up creating one vhost and one SSL certificate per website, and point all websites to the same document root, but we have a complex nginx setup (ssl, memcached, redirects, etc.) and we would like to minimize the website creation process as much as possible, so this would be the last (and most work needed) solution.

Thank you.

Improve this question

2 Answers 2

Reset to default
1

You cannot use more than one ssl_certificate entry per vhost. That is just not how it works.

I would recommend using a configuration management system to handle creation of domains - the currently most popular ones are ansible, puppet and chef. Whether you choose to have one vhost server 100 hostnames or just one is up to you, but the point of automating things with a CMS is that the amount of manual work needed to set up a web site is minimized, regardless of the specific configuration.

Improve this answer
2
  • In fact we already use ISP Config for other "classic" websites, with 1 vhost per site. I guess the simplest solution is that we do the same for the WordPress network's website, and just use a different vhost template to point to the same document root. Thank you for your anwser :)
    – Mathieu Bautista
    Jun 21, 2017 at 14:59
  • We ended up creating a vhost for each website. We use ISP Config with a custom nginx vhost template so we can easily create a vhost with a specific SSL certificate with a few clicks.
    – Mathieu Bautista
    Sep 6, 2019 at 6:55
0

I personally find using SAN certificates in this way a bit hacky and unprofessional looking when you view a cert for a website and see dozens of unrelated sites on the same certificate.

Could you not create a vhost file for each site (or per <=100 hosts if you prefer), and just keep all the actual configuration (path/redirects/etc) as an include?

server {
    listen xyz;
    server_name example.com
                example2.com;

    ssl_certificate certfile;
    ssl_certificate_key keyfile;

    include templates/standard-website-config;
}

In the main nginx conf you'd just have something like the below to include all the vhost config files.

http {
    ... some_standard_http_config ....

    include sites/*;
}
Improve this answer
1
  • Thank you for your answer. You're right a SAN is a bit hacky. We'll end up creating a vhost per site with all vhost pointing to the same document root, and we'll use includes to factorize the config. We'll try to optimize the creation process in a second time. Thank you :)
    – Mathieu Bautista
    Jun 21, 2017 at 15:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .