I'm currently setting up a (semi-serious) server with nginx for the first time. I have a couple of domains and subdomains and want to use SSL as much as possible to keep the traffic to and from my site reasonably secure. A problem that I have run into lately is that I find myself unable to properly handle SSL-requests to non-existant subdomains without resorting to wildcard certificates.

Basically, my setup is very close to this one (nginx, redirects to https, multiple subdomains, Let's Encrypt certificates for all valid subdomains, catch-all for invalid domains).

It's really NotNice™ that users who misstype a subdomain will get an error along the lines of "This connection can not be trusted" (or worse, depending on browser). It might undermine trust in my website. For example https://www.my-domain.com works but https://ww.my-domain.com will tell the user that my site is not to be trusted. Since I'm expecting a substantial amount of my readership to be not exactly tech-savvy I can't expect them to understand or diagnose this themselves.

So what I want is to basically just abort the connection when somebody visits a non-existing subdomain, so that they get a "connection refused" error, not a "this site is evil you might be getting hacked" error. Not only is it closer to the truth (the site can be trusted, there's just nothing there), it might also help them spot their error since it's pointing out that the address is wrong and not the certificate.

In fact, that's already what I do for non-SSL connections. I have a catchall server directive in nginx that just returns 404 for anything that comes in on port 80 and doesn't match a known subdomain. So how would I go about actually flat out refusing an ssl connection in nginx?

I know I can't use HTTP return codes since in this case there is no connection in the first place. That's the whole point of ssl. I can't use wildcard certificates since they are too expensive. I would like to avoid touching iptables since that's awkward to maintain when I change subdomains. However, if that's the best solution I might look into it. Are there any clever DNS entries that could help?


I would disable the catch-all for invalid domains. That way, attempting to access https://ww.my-domain.com in a web browser would result in a less-scary “Server not found” error which the user would be more familiar with. In the case of Firefox, it helpfully suggests that the user,

Check the address for typing errors such as ww.example.com instead of www.example.com

That seems to be the best alternative to not obtaining a wildcard certificate to correspond with all the possibilities configured by the catch-all DNS resolution.

  • 1
    trying it out now. I'm a bit inexperienced with DNS record editing. Anyways, name servers will need a bit to catch up. If it works as intended (as I expect it will) I'll mark your answer accepted. – MadMonkey May 27 '16 at 14:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.