I need to setup a server that will server same content over SSL using different domain names. The problem is that I need an ability to add new domain names as easily as possible. Assuming that all domain names are already configured to my server I guess whether it is possible to setup nginx (or maybe another reverse-proxy) in a way so it will listen all requests to a particular IP and after obtaining a HTTPS request try to lookup a certificate for domain that was used to make this request in some folder or DB and serve the request if certificate was found (so we can establish secure connection), or reject the connection if certificate wasn't found.

I'm not sure that it is possible at all or maybe I'm thinking about something reckless but since I wasn't able to find any info on the net I've decided to ask here.

As I understand the most simple solution for this will be to add a separate configuration for each domain that should be supported.


I guess there is no other solution than creating a separate config for each vhost. Using templates that should be quite simple.

However, SNI is not yet supported by some browsers (all recent browsers do). These browsers might show an invalid certificate message.

If you want to reject connections for some vhosts without certificate you should simply not enable ssl on these vhosts. Add a default server that catches all connections for unknown vhosts on the ssl port and return an error (403 forbiden or non standard 444 for tcp reset):

server {
    listen 433 default_server ssl;
    ssl_certificate       common.crt;
    ssl_certificate_key   common.key;
    return 403;

You can not prevent the invalid certificate message on vhosts without ssl, as it is not possible to cancel the tcp connection before the ssl handshake using nginx. You might try iptables to reject non sni ssl handshakes but that might be a bit tricky to configure correctly and will probably require some knowledge of ssl specifications.

  • last I looked, browsers that don't support SNI still make up about 15% of web traffic. – Chris S Feb 11 '14 at 15:23
  • These 15% are probably the last Windows XP clients that have not updated yet. All recent browsers on other platforms support SNI, (check the results form ssllabs.com). – xblax Feb 11 '14 at 15:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.