0

I have a single server block that I want to offer two kinds of certificate for: one ECC and one RSA. The ECC cert is because for certain of the clients ECDSA is the only viable option in TLS 1.2 (and they don't support 1.3). The RSA cert is for widest compatibility across systems. It'd be nice to also offer EdDSA for speed, but that's not a requirement.

Per Can a server offer more than one TLS certificate? it's possible -- but I don't know whether it's possible to do it with nginx.

I do not mean that I want to offer a different certificate per DNS name or per port or anything like that -- I want the difference to be based on the client's capabilities.

I'm using nginx as a TLS-terminating reverse proxy. I have flexibility to upgrade my nginx version and install plugins. Although I need to support certain old systems, they all support TLS 1.2+ and they all support at least one still-strong cipher suite on it.

1 Answer 1

2

You can specify multiple certificate types by just entering multiple directives like this:

ssl_certificate /path/to/rsa_cert;
ssl_certificate_key /path/to/rsa_key;
ssl_certificate /path/to/ecc_cert;
ssl_certificate_key /path/to/ecc_key;

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .