0

I have two websites on a server, each with their own vhost file in Nginx. Both are also on Cloudflare, and both have SSL certificates that I've got via Let's Encrypt.

Both sites' vhosts files are like this:

server {
    server_name domain.co.uk www.domain.co.uk;
    listen 80;
    listen domain.co.uk:80;
    return 301 https://$http_host$request_uri;

    // ...
}

server {
    server_name domain.co.uk www.domain.co.uk;

    listen 443;
    listen domain.co.uk:443;

    // ...
}

I'm finding that if I request the second site in the browser, sometimes it'll show the first site. Is this because of the generic listen [port]; lines?

Additionally if I make an SSL request the browser throws a security warning for the host name mismatch, because it's trying to show the first domain's SSL certificate.

I find that if I take off listen 80; or listen 443; then Nginx throws a fit because Cloudflare's IPs are dynamic, and don't match the listen [host]:443; lines.

I'm not sure if I'm fundamentally not understanding Nginx and how it works.

  • If you are using Flexible SSL on CloudFlare, then the request will always hit the virtualhost for port 80, in order to enable end-to-end SSL you need to enable Full SSL in the Crypto tab of your CloudFlare dashboard: support.cloudflare.com/hc/en-us/articles/… – mjsa Jun 26 '16 at 21:33
0

Remove

listen domain.co.uk:80;

Here's the start of one of my configs

server_name www.example.com;
listen 443 ssl http2;

ssl_certificate /var/lib/acme/certs/***CERT_DIRECTORY/fullchain;
ssl_certificate_key /var/lib/acme/certs/***CERT_DIRECTORY/privkey;

# Set up preferred protocols and ciphers. TLS1.2 is required for HTTP/2
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;

# This is a cache for SSL connections
ssl_session_cache shared:SSL:2m;
ssl_session_timeout 60m;

I have another server for port 80 that just forwards to the SSL server. Tutorial here.

  • Yep this is how I fixed it. I rewrote all the vhost files from scratch and they now seem to be working fine. – jonbaldie Jun 26 '16 at 8:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.