4

I have an ubuntu hardy with nginx version: nginx/0.5.33

I have multiple servers and they are working perfectly on port 80.

Now, some of them I want to serve using SSL on port 443, and each of them have their own ssl certificate.

The problem is that every domain is using the same ssl certificate, and an error appears in the browser saying a mismatch name ssl certificate.

I'm sure all the certificates are valid and are correct, the paths are correct. If I serve only ONE domain, the ssl certificate is OK, so all the files are OK.

Why is nginx using always the same ssl certificate for all server configurations ?

Here are two examples, if both are active, it takes always the ssl for domain1, if I remove the domain1, domain2 with ssl works ok with the correct ssl file.

thanks,

m.


nginx.conf file:

user www-data;
worker_processes  1;

error_log  /var/log/nginx/error.log;
pid        /var/run/nginx.pid;

events {
worker_connections  1024;
}

http {
include       /etc/nginx/mime.types;
default_type  application/octet-stream;

access_log  /var/log/nginx/access.log;

sendfile        on;
#tcp_nopush     on;

#keepalive_timeout  0;
keepalive_timeout  65;
tcp_nodelay        on;

gzip  on;

include /etc/nginx/conf.d/*.conf;
}

domain1.conf file:

server {

        listen 443;

        server_name domain1.montx.com;
        root /etc/nginx/sites-available/domain1;
        access_log /etc/nginx/sites-available/domain1/log/nginx.log;
        error_page 500 502 503 504 /500.html;
        client_max_body_size 50M;

        ssl on;
        ssl_certificate /etc/nginx/conf.d/domain1.crt;
        ssl_certificate_key /etc/nginx/conf.d/domain1.key;

         location / {

                auth_basic "Restricted";
                auth_basic_user_file  domain1_htpasswd;
                 }
}

domain2.conf file:

upstream thin_domain2 {
    server   unix:/tmp/thin_domain2.0.sock;
    server   unix:/tmp/thin_domain2.1.sock;
    server   unix:/tmp/thin_domain2.2.sock;
}


server {

    listen 443;
    ssl on;
    ssl_certificate /etc/nginx/conf.d/domain2.crt;
    ssl_certificate_key /etc/nginx/conf.d/domain2.key;




    server_name domain2.montx.com;
    root /u/apps/domain2/current/public;
    access_log /u/apps/domain2/shared/log/nginx.log;
    error_page 500 502 503 504 /500.html;
    client_max_body_size 50M;

    # First rewrite rule for handling maintenance page
    if (-f $document_root/system/maintenance.html) {
            rewrite ^(.*)$ /system/maintenance.html last;
            break;
    }

    location / {
            index index.html index.htm;

            # Forward information about the client and host
            # Otherwise our Rails app wouldn't have access to it
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header Host $http_host;
            proxy_max_temp_file_size 0;
            # Directly serve static content
            location ~ ^/(images|javascripts|stylesheets)/ {
                    expires 10y;
            }
            if (-f $request_filename) {
                    break;
            }

            # Directly serve cached pages
            if (-f $request_filename.html) {
                    rewrite (.*) $1.html break;
            }

            # Otherwise let Thin handle the request
            if (!-f $request_filename) {
                    proxy_pass http://thin_domain2;
                    break;
            }
    }
}

3 Answers 3

5

You need to assign an individual IP address for each SSL cert you want to use.

http://httpd.apache.org/docs/2.0/ssl/ssl_faq.html#vhosts

http://www.ruby-forum.com/topic/186664#815383

3
  • So, if I have three ssl cert, I need three different IP, right ? Another option would be using a wildcard ssl certificate, as in this case, all ssl cert are for the same domain, I'm right ? thanks, r.
    – mongeta
    Aug 3, 2010 at 10:26
  • That's right. Wildcard ssl cert is probably the simplest way to do it. Aug 3, 2010 at 10:38
  • I don't know if this was the case in 2010 nginx, but it's definitely not the case today, with SNI. Apr 8, 2017 at 3:55
0

Add IP address bindings for each of your server block:

listen yourIPaddress:443 ssl;
0

TLS SNI

SNI allows browser to pass requested server name during the SSL handshake

Nginx support TLS SNI

To check if Nginx enabled TLS SNI

$ nginx -V
...
TLS SNI support enabled
...

and check the error_log that without this warning

nginx was built with SNI support, however, now it is linked
dynamically to an OpenSSL library which has no tlsext support,
therefore SNI is not available

Official HTTPS document has more detail.

If enabled TLS SNI, the following config works fine.

# Create the self signed certificate

openssl req -x509 -newkey rsa -nodes -keyout default.key -days 36500 -out default.crt -subj "/CN=example.org"

openssl req -x509 -newkey rsa -nodes -keyout a.key -days 36500 -out a.crt -subj "/CN=a.example.org"

openssl req -x509 -newkey rsa -nodes -keyout b.key -days 36500 -out b.crt -subj "/CN=b.example.org"
    server {
        listen       443 ssl default_server;
        server_name  "";

        ssl_certificate      default.crt;
        ssl_certificate_key  default.key;

        add_header "Content-Type" "text/plain";
        return 200 "default page";
    }

    server {
        listen       443 ssl;
        server_name  a.example.org;

        ssl_certificate      a.crt;
        ssl_certificate_key  a.key;

        add_header "Content-Type" "text/plain";
        return 200 "a.example.org page";
    }

    server {
        listen       443 ssl;
        server_name  b.example.org;

        ssl_certificate      b.crt;
        ssl_certificate_key  b.key;

        add_header "Content-Type" "text/plain";
        return 200 "b.example.org page";
    }
# Add -v to verify the certificate

$ curl --insecure --resolve "a.example.org:443:127.0.0.1" https://a.example.org

a.example.org page

$ curl --insecure --resolve "b.example.org:443:127.0.0.1" https://b.example.org

b.example.org page

$ curl --insecure https://127.0.0.1

default page

Ref: Nginx TLS SNI

If Nginx disable TLS SNI

Nginx will use default server certificate for all request

Official HTTPS document

This is caused by SSL protocol behaviour. The SSL connection is established before the browser sends an HTTP request and nginx does not know the name of the requested server. Therefore, it may only offer the default server’s certificate.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .