1

I have an nginx server running with two IP addresses, say 1.2.3.4 and 4.3.2.1. Besides there are two wildcard SSL certificates for *.example.net (i.e. wc1, pointing to 1.2.3.4) and *.sub.example.net (i.e. wc2, pointing to 4.3.2.1).

The nginx docs mention that you can share a wildcard certificate between server instances like this:

ssl_certificate      wc1.crt;
ssl_certificate_key  wc1.key;

server {
    listen           1.2.3.4:443;
    server_name      www.example.net;
    ssl              on;
    ...
}

server {
    listen           1.2.3.4:443;
    server_name      test.example.net;
    ssl              on;
    ...
}

However, I was wondering whether this same construct is possible to use with the second wildcard certificate too. Both domains have around 500 subdomains.

Do they not get mixed up, since the ssl_certificate construct is now global?

1

Try this:

server {
    listen           1.2.3.4:443 default_server ssl;
    server_name      _;
    ssl_certificate      wc1.crt;
    ssl_certificate_key  wc1.key;
}

server {
    listen           4.3.2.1:443 default_server ssl;
    server_name      _;
    ssl_certificate      wc2.crt;
    ssl_certificate_key  wc2.key;
}

server {
    listen           1.2.3.4:443 ssl;
    server_name      www.example.net;
    ...
}

server {
    listen           1.2.3.4:443 ssl;
    server_name      test.example.net;
    ...
}

server {
    listen           4.3.2.1:443 ssl;
    server_name      www.sub.example.net;
    ...
}

server {
    listen           4.3.2.1:443 ssl;
    server_name      test.sub.example.net;
    ...
}

I can affirm that this method definitely works with one wildcard certificate, so here's hoping it works with two or more.

Credit: https://serverfault.com/a/548942/185775

0

The ssl_certificate directive can either be used at the http block level (in which case it applies to all server blocks), or the server level (in which case it only applies to that specific server block). If you want to use different certificates just define the ssl_certificate inside the appropriate server block.

  • I only have two certificates, but each certificate is used around 500 times in a subdomain. That's why I wanted to share the memory of the certificate footprint along these 500 subdomains. – hvtilborg Aug 2 '12 at 7:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.