0

I need to configure several domains on the same server, all with SSL and some of them being wildcard subdomains.

I have the following domains pointing to same IP: projects.acme.com acme.server.com *.acme.server.com

They should all have SSL. I have two different wildcard certificates (one for *.acme.com and one for *.server.com - generic example names used here, obivously).

I'm using nginx in front, and two separate node.js servers on ports 3001and 3003.

This is a valid nginx config for projects.acme.com, and it works perfectly:

    ######################################################
    # sx ->  portal server #
    ######################################################

    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_set_header X-NginX-Proxy true;
    add_header   Access-Control-Allow-Origin *.server.com;
    proxy_redirect   off;
    proxy_ssl_session_reuse off;

    # limit brute force, ddos
    limit_req_zone $binary_remote_addr zone=one:1000m rate=5000r/s;

    # the IP on which the node server is running
    upstream portal {
        server localhost:3001;
    }



    # http/s redirect
    server {
        listen 80;
        server_name projects.acme.com;
        return 301 https://$server_name$request_uri;
    }


    # the nginx server instance
    server {

        listen              443 ssl;
        server_name             projects.acme.com;
        access_log              /var/log/nginx/access.projects.acme.log;
        error_log               /var/log/nginx/errors.projects.acme.log;

        ssl_session_cache           shared:SSL:1m;
        ssl_session_timeout         10m;
        ssl                 on;
        ssl_certificate             /etc/ssl/projects_acme_com.pem;
        ssl_certificate_key         /etc/ssl/projects_acme_com.key;
        ssl_verify_client       off;

        limit_req zone=one      burst=5;        
        client_max_body_size        2000m;

        ssl_protocols               TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers   on;
            ssl_ciphers 'AES128+EECDH:AES128+EDH';

            add_header          Strict-Transport-Security "max-age=63072000; includeSubdomains;";

        location / {
            proxy_pass http://portal;
        }

        # 502 handling
        error_page 502 /502.html;
        location /502.html {
            root /var/www/server.com/app/public/error;
        }

    }

However, when trying to add the other domain, acme.server.com and *.acme.server.com, I get errors. First of all, I can't get the subdomain to point to a different port. Secondly, I get certificate errors, ERR_INSECURE_RESPONSE.

This is what I've tried to do:

    ######################################################
    # sx ->  portal server #
    ######################################################

    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_set_header X-NginX-Proxy true;
    add_header   Access-Control-Allow-Origin *.server.com;
    proxy_redirect   off;
    proxy_ssl_session_reuse off;

    # limit brute force, ddos
    limit_req_zone $binary_remote_addr zone=one:1000m rate=5000r/s;

    # the IP on which the node server is running
    upstream portal {
        server localhost:3001;
    }

    upstream *.acme.server.com {
        server localhost:3003;
    }

    # http/s redirect
    server {
        listen 80;
        server_name projects.acme.com;
        return 301 https://$server_name$request_uri;
    }


    # the nginx server instance
    server {

        listen              443 ssl;
        server_name             projects.acme.com;
        access_log              /var/log/nginx/access.projects.acme.log;
        error_log               /var/log/nginx/errors.projects.acme.log;

        ssl_session_cache           shared:SSL:1m;
        ssl_session_timeout         10m;
        ssl                 on;
        ssl_certificate             /etc/ssl/projects_acme_com.pem;
        ssl_certificate_key         /etc/ssl/projects_acme_com.key;
        ssl_verify_client       off;

        limit_req zone=one      burst=5;        
        client_max_body_size        2000m;

        ssl_protocols               TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers   on;
            ssl_ciphers 'AES128+EECDH:AES128+EDH';

            add_header          Strict-Transport-Security "max-age=63072000; includeSubdomains;";

        location / {
            proxy_pass http://portal;
        }

        # 502 handling
        error_page 502 /502.html;
        location /502.html {
            root /var/www/server.com/app/public/error;
        }

    }


    server {

        listen              443 ssl;
        server_name             server.com;
        access_log              /var/log/nginx/access.acme.server.log;
        error_log               /var/log/nginx/errors.acme.server.log;

        ssl_session_cache           shared:SSL:1m;
        ssl_session_timeout         10m;
        ssl                 on;
        ssl_certificate             /etc/ssl/server_com.crt;
        ssl_certificate_key         /etc/ssl/server_com.key;
        ssl_verify_client       off;

        limit_req zone=one      burst=5;        
        client_max_body_size        2000m;

        ssl_protocols               TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers   on;
            ssl_ciphers 'AES128+EECDH:AES128+EDH';

            add_header          Strict-Transport-Security "max-age=63072000; includeSubdomains;";

        location / {
            proxy_pass http://127.0.0.1:3003;
        }

        # 502 handling
        error_page 502 /502.html;
        location /502.html {
            root /var/www/server.com/app/public/error;
        }

    }

This does not work. What does work, however, is to add a location to the first server block, with /tiles/ etc - that actually sends request to the correct port, but I need to use the subdomains (and sub-subdomains).

Any pointers greatly appreciated!

  • 2
    Two things... First, *.server.com is not a valid certificate for *.acme.server.com (wildcards can't include additional subdomains). Second, why use separate ports? You can listen for different hostnames on the same port; Just create different virtual hosts and assign the correct server_name; nginx is smart enough to reply with the right site. – Hyppy Feb 4 '15 at 18:05
  • Thanks, didn't know about wildcards and additional subdomains. I use separate ports (3001/3) because they are separate servers - different instances of nodejs servers. From outside all goes to port 443 though. But maybe I'm misunderstanding what you mean. – knutole Feb 4 '15 at 18:08
  • Does this mean, by the way, that it's never possible to have SSL on a sub-subdomain like *.acme.server.com? – knutole Feb 4 '15 at 18:09
  • 1
    Nope, it just means that you need a separate certificate for *.acme.server.com. – Hyppy Feb 4 '15 at 18:10
  • Should I configure two server blocks though? – knutole Feb 4 '15 at 18:11
0

If your clients do support SNI, then you can create multiple virtualhosts on the same 443 port of the same ip address, and use it this way. With Windows XP used base diminishing, your clients can use any of the modern OS/browsers.

Youb also probably forgot to pass the Host header to the backend with proxy_set_header Host $host, in case your backend needs it (for example if your backends are apaches configured on the same port).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.