So I´ve removed my default vhost config from /etc/nginx/sites-available/
, since I don´t need to catch users accessing a non-existent subdomain (Debian 9).
Problem: When calling a random subdomain with https, f.e. https://abc.example.com
, NGINX will apply it´s default behavior and use the first listen 443
server-block it can find in my configuration files. This means that, when a user mistakenly accesses a false subdomain with https, instead of getting a 404 error (like when calling abc.amazon.com or abc.google.com), he will get a red exclamation mark and an certificate name missmatch
error (chrome (NET::ERR_CERT_COMMON_NAME_INVALID
)), which is way more frightening than a understandable 404 error.
Question: Is there a way to disable this default nginx behavior of using the first ssl server-block it can find?
OH, AND: Even when re-creating the default vhost (I´ve copied a backup of it), NGINX shows the same behavior when accessing a random subdomain with https. Also, firefox will use my port 80
server block to redirect any traffic from http to https://www.example.com$request_uri;
. Chrome will redirect http to https when calling a random subdomain, but keep the subdomain (a rule I´ve never specified). Here are my 2 config files in /etc/nginx/sites-available/
I´m currently using.
default (config, updated)
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name _;
return 404;
}
server {
listen 443 ssl default_server;
server_name _;
ssl_certificate /etc/nginx/ssl/nginx.crt;
ssl_certificate_key /etc/nginx/ssl/nginx.key;
return 444;
}
www.example.com (config)
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
include /etc/nginx/snippets/letsencrypt.conf;
return 301 https://www.example.com$request_uri;
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name example.com;
ssl on;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;
ssl_dhparam /etc/letsencrypt/live/example.com/dh.pem;
ssl_protocols TLSv1.2;
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
ssl_prefer_server_ciphers on;
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;
resolver 8.8.8.8;
add_header X-Frame-Options "SAMEORIGIN";
add_header x-xss-protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
return 301 https://www.example.com$request_uri;
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name www.example.com;
ssl on;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;
ssl_dhparam /etc/letsencrypt/live/example.com/dh.pem;
ssl_protocols TLSv1.2;
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
ssl_prefer_server_ciphers on;
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;
resolver 8.8.8.8;
add_header X-Frame-Options "SAMEORIGIN";
add_header x-xss-protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
root /var/www/www.example.com;
index index.php;
location ~ \.php$ {
include snippets/fastcgi-php.conf;
fastcgi_pass unix:/run/php/php7.0-fpm.sock;
}
location / {
try_files $uri $uri/ =404;
}
}
EDIT: These are my DNS Records:
(HOST) * (TYPE) A (DESTINATION) MYIP
(HOST) @ (TYPE) A (DESTINATION) MYIP
and some more for ftp, mail etc
How will I have to change the above DNS to only include my Subdomains (imap,webmail,www,smtp)? Also, what is the purpose of the following preconfigured line? Will I have to change it to imap.example.com so that it works properly? (I don't have a mail subdomain)
(HOST) @ (TYPE) MX (MX) 10 (DESTINATION) mail.example.com