1

I have an NGINX development server. I have a large number of configuration directives which drive various features of the server.

I want to be able to access the server via SSL. The problem is that I may access the server from different domain names. For example, inside my LAN I might use 192.168.1.100, but on the Internet (via NAT forwarding) I'd use my home domain name, or in some specific instances the server's external IP address.

Since SSL depends on the hostname the client requested, I want to be able to generate and serve up multiple SSL certificates based on how the server is being accessed. For example, one certificate's CN would be "https://192.168.1.100" while another's would be "https://www.example.com" and yet another's might be "https://12.34.56.78".

I think it may be possible to accomplish this by duplicating server blocks like this:

server {
    listen 443 ssl;
    server_name 192.168.1.10;
    ssl_certificate /etc/nginx/192.168.1.10.crt;
    ssl_certificate_key /etc/nginx/192.168.1.10.pem;
    location / {
        root   /var/www/root;
        index  index.html index.htm;
    }
}
server {
    listen 443 ssl;
    server_name www.example.com;
    ssl_certificate /etc/nginx/www.example.com.crt;
    ssl_certificate_key /etc/nginx/www.example.com.pem;
    location / {
        root   /var/www/root;
        index  index.html index.htm;
    }
}
...

The problem is that I have several (i.e. more than 10) location blocks inside my server configuration because I am testing multiple configurations, environments and web applications on the same server. Most of these locations include either a FastCGI pass through and/or an alias or rewrite directive.

Duplicating all of the location blocks is not only tedious but could lead to inconsistencies if I forget to update every single one.

In addition, I have also planned to possibly use this environment in the future in such a way that would actually use subdomains, each with different location blocks. So now we end up with something like this:

  • www.example.com uses location parameter set 1
  • 12.34.56.78 uses location parameter set 1
  • test.example.com uses location parameter set 2
  • 192.168.1.100 uses location parameter set 2

As long as I don't use SSL, this isn't an issue since the server will always serve out of the "default" server block. But SSL seems to require a separate server block for each domain name in order to serve the unique certificates...

Ideally, what I'd like is some kind of "named grouping/include" where I could write all the location blocks in a separate section and then include them within the server blocks. My "ideal" solution if it existed:

config config1 {
    location / {
        root   /var/www/root;
        index  index.html index.htm;
    }
    location /testapp1 {
        include fastcgi_params;
        fastcgi_split_path_info ^(/testapp1)(.*)$;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_pass unix:/run/testapp1.sock;
    }
}
config config2 {
    location / {
        root   /var/www/root2;
        index  index.html index.htm;
    }
    location /testapp2 {
        include fastcgi_params;
        fastcgi_split_path_info ^(/testapp2)(.*)$;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_pass unix:/run/testapp2.sock;
    }
}

server {
    listen 443 ssl;
    server_name 192.168.1.100;
    ssl_certificate /etc/nginx/192.168.1.10.crt;
    ssl_certificate_key /etc/nginx/192.168.1.10.pem;
    include config config1;
}
server {
    listen 443 ssl;
    server_name www.example.com;
    ssl_certificate /etc/nginx/www.example.com.crt;
    ssl_certificate_key /etc/nginx/www.example.com.pem;
    include config config1;
}
server {
    listen 443 ssl;
    server_name test.example.com;
    ssl_certificate /etc/nginx/test.example.com.crt;
    ssl_certificate_key /etc/nginx/test.example.com.pem;
    include config config2;
}
...
  • Jfyi, ssl certificates must should not be issued for ip addresses – Alexey Ten Jun 24 '15 at 4:04
2

Because SSL directives are only available in server or http contexts, you cannot work around having to write one block per certificate.

You can, however, move the contents, which are always the same(?), to a different file. This file would then be included in every block. So that’s almost like your envisioned solution.

You might also want to consider using certificates which are valid for multiple subjects, using the Subject Alternative Name field. When going commercial, this is quite expensive, though.

  • 1
    Thank you! I didn't realize includes could be arbitrary - I thought they only worked at the http level directly. I also just read about multiple CNs per certificate, which will work as a stopgap solution for now as long as I'm not doing subdomains. (This server is only for internal development, and I am using my own self-signed CA which I add to my devices; production servers would go through "normal" means of SSL authentication with only one valid domain name.) – fdmillion Jun 23 '15 at 19:21
0

I would use a multi-domain certificate using Subject Alternative Names. You then just need one server block for all of your various hostnames. I often create these with a wildcard host specification (*.domain.com) in addition to any other domains I require. This makes is easy to use the same certificate for www.domain.com, dev1.domain.com, staging.domain.com etc.

While for a different purpose, this question has the procedure:

How to create a self-signed SSL certificate with subject alternate names (SAN) for IIS websites

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.