https with sni two certs tho server names but same config. can I use one server block?

Question

I often encounter following problem.

I have an nginx server serving two hostnames via https on the same IP and the same port. Each host name has it's own cert.

What I am doing so far is to have two configurations:

server {
    listen              443 ssl;
    server_name         www.example1.com;
    ssl_certificate     www.example1.com.crt;
    ssl_certificate_key www.example1.com.key;
    ssl_protocols       ...;
    ssl_ciphers         ...;
    ...
}

and

server {
    listen              443 ssl;
    server_name         www.example2.com;
    ssl_certificate     www.example2.com.crt;
    ssl_certificate_key www.example2.com.key;
    ssl_protocols       ...;
    ssl_ciphers         ...;
    ...
}

Is there any trick to have this done in only one server block?

The reason I'm asking is, that both servers share apart of the name and the cert exactly the same config.

What I do so far is:

server {
    listen              443 ssl;
    server_name         www.example1.com;
    ssl_certificate     www.example1.com.crt;
    ssl_certificate_key www.example1.com.key;
    include /etc/nginx/common_config/example1_and_2/*;
}

server {
    listen              443 ssl;
    server_name         www.example2.com;
    ssl_certificate     www.example2.com.crt;
    ssl_certificate_key www.example2.com.key;
    include /etc/nginx/common_config/example1_and_2/*;
}

Can this be improved is there some standard recommendation? If this is at good as it gets, is there at least a recommendation for the path to such common config giles?

Answer 1

The server_name can have a list of multiple hostnames, e.g.

server_name example.org www.example.org example.com www.example.com;

While (since 1.11.0) it has been possible to load multiple certificate in a single server { } block, it's for multiple different types (e. g.RSA and ECDSA), not for multiple hostnames. But it's possible to use variables in ssl_certificate:

Since version 1.15.9, variables can be used in the file name when using OpenSSL 1.0.2 or higher:

ssl_certificate $ssl_server_name.crt;
ssl_certificate_key $ssl_server_name.key; 

Note that using variables implies that a certificate will be loaded for each SSL handshake, and this may have a negative impact on performance.

For the performance impact mentioned I wouldn't recommend that, but would combine all the hostnames for the same server { } block into a single certificate as Subject Alternative Names (SAN), instead.