3

For a web service we have two certificates: myservice.com and api.myservice.com. Both have the same application (document root) but are serverd over HTTPS with different certificates. Unfortunately, we don't have a two-domain certificate at this moment.

Currently, I have to define two server blocks, one for each pointing to the same root. The only difference is the ssl_certificate directive, but that one can be declared only on http or server level.

Nevertheless, is there a way to avoid the copy/paste in the server blocks? This is an example code:

server {
    listen      443;
    server_name .myservice.com;
    root        /var/www/myservice.com/public;

    include conf.d/common.conf.inc;

    ssl                 on;
    ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers         ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4:HIGH:!MD5:!aNULL:!eNULL:!NULL:!DH:!EDH:!AESGCM;
    ssl_session_cache   shared:SSL:5m;
    ssl_session_timeout 10m;
    ssl_certificate     /path/to/myservice.com.bundle.crt;
    ssl_certificate_key /path/to//myservice.com.key;

    ssl_prefer_server_ciphers on;
}

server {
    listen      443;
    server_name api.myservice.com;
    root        /var/www/myservice.com/public;

    include conf.d/common.conf.inc;

    ssl                 on;
    ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers         ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4:HIGH:!MD5:!aNULL:!eNULL:!NULL:!DH:!EDH:!AESGCM;
    ssl_session_cache   shared:SSL:5m;
    ssl_session_timeout 10m;
    ssl_certificate     /path/to/api.myservice.com.bundle.crt;
    ssl_certificate_key /path/to//myservice.com.key;

    ssl_prefer_server_ciphers on;
}

/edit: As requested, here the output of nginx -V:

nginx version: nginx/1.2.7

TLS SNI support enabled configure

arguments: --prefix=/usr/share/nginx --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-client-body-temp-path=/var/lib/nginx/body --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-log-path=/var/log/nginx/access.log --http-proxy-temp-path=/var/lib/nginx/proxy --http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --lock-path=/var/lock/nginx.lock --pid-path=/run/nginx.pid --with-pcre-jit --with-debug --with-http_addition_module --with-http_dav_module --with-http_flv_module --with-http_geoip_module --with-http_gzip_static_module --with-http_image_filter_module --with-http_mp4_module --with-http_perl_module --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_stub_status_module --with-http_ssl_module --with-http_sub_module --with-http_xslt_module --with-ipv6 --with-sha1=/usr/include/openssl --with-md5=/usr/include/openssl --with-mail --with-mail_ssl_module --add-module=/build/buildd/nginx-1.2.7/debian/modules/nginx-auth-pam --add-module=/build/buildd/nginx-1.2.7/debian/modules/chunkin-nginx-module --add-module=/build/buildd/nginx-1.2.7/debian/modules/headers-more-nginx-module --add-module=/build/buildd/nginx-1.2.7/debian/modules/nginx-development-kit --add-module=/build/buildd/nginx-1.2.7/debian/modules/nginx-echo --add-module=/build/buildd/nginx-1.2.7/debian/modules/nginx-http-push --add-module=/build/buildd/nginx-1.2.7/debian/modules/nginx-lua --add-module=/build/buildd/nginx-1.2.7/debian/modules/nginx-upload-module --add-module=/build/buildd/nginx-1.2.7/debian/modules/nginx-upload-progress --add-module=/build/buildd/nginx-1.2.7/debian/modules/nginx-upstream-fair --add-module=/build/buildd/nginx-1.2.7/debian/modules/nginx-dav-ext-module

  • Hmmm are you trying to serve sites with two different ssl on one ip?? – B14D3 Feb 17 '14 at 9:25
  • Show output from nginx -V – B14D3 Feb 17 '14 at 9:31
  • @B14D3 SNI works perfect here :) Version info appended – Jurian Sluiman Feb 17 '14 at 9:50
3

You already know (and are using) the answer! Just include the common parts from a separate file.

1

You can avoid duplicating virtualhost by doing something like this with "if" and define one virtualhost:

server {
    listen      443;
    server_name .myservice.com api.myservice.com;
    root        /var/www/myservice.com/public;

    include conf.d/common.conf.inc;

    ssl                 on;
    ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers         ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4:HIGH:!MD5:!aNULL:!eNULL:!NULL:!DH:!EDH:!AESGCM;
    ssl_session_cache   shared:SSL:5m;
    ssl_session_timeout 10m;
    ssl_prefer_server_ciphers on;

  if ($server_name = .myservice.com) {
    ssl_certificate /path/to/myservice.com.bundle.crt;
    ssl_certificate_key /path/to//myservice.com.key;
  }
  if ($server_name = api.myservice.com) {
    ssl_certificate /path/to/api.myservice.com.bundle.crt;
    ssl_certificate_key /path/to//myservice.com.key;;
  }
  ...
}

  • Doesn't work for me. "ssl_certificate" directive is not allowed here – PJ Brunet Sep 23 '17 at 8:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.