2

I have two domains example.com and example.org. Both domains point to the same server with a static IP.

The first configuration file (for example.com):

# /etc/nginx/sites-enabled/example.com.conf

# Catchall for all non-existent domains
server {
   return 404;
}

# Should redirect http://example.com to https://example.com
server {
   listen 80;
   server_name example.com;
   return 301 https://$server_name$request_uri;
}

# Should redirect http://www.example.com to https://www.example.com
server {
  listen 80;
  server_name www.example.com;
  return 301 https://$server_name$request_uri;
}

server {
  listen 443 ssl;
  server_name example.com;

  # Using LetsEncrypt certs
  ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

  root /var/www/example.com/;
  index index.html;

}

And here's the other configuration file

# /etc/nginx/sites-enabled/example.org.conf

# Should redirect http://example.org to https://example.org
server {
   listen 80;
   server_name example.org;
   return 301 https://$server_name$request_uri;
}

# Should redirect http://www.example.org to https://www.example.org
server {
  listen 80;
  server_name www.example.org;
  return 301 https://$server_name$request_uri;
}

server {
  listen 443 ssl;
  server_name example.org;

  ssl_certificate /etc/letsencrypt/live/example.org/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/example.org/privkey.pem;

  root /var/www/example.org/;
  index index.html;

}

So here's the problem

http://example.com -> https://example.com ✔
https://example.com ✔
http://www.example.com -> https://www.example.com ✔
https://www.example.com ✔

http://example.org -> https://example.org ✔
https://example.org ✔
http://www.example.org -> https://www.example.org ✗
https://www.example.org ✗

In the last two cases (www.example.org) the certificate of example.com is served.

SNI support is enabled: $ nginx -V => TLS SNI support enabled

What's wrong with my config?

2 Answers 2

3

You do not have server_names for the secure versions of your domains when using the www. prefix, so the default server is used in each case.

In the absence of an explicit default server, the first server block matching the appropriate port is used.

You need to add the www. variants to the server_name directive in your secure server blocks, or use the wild card syntax.

See this document for details.

For example:

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl;
    server_name example.com www.example.com;
    ...
}
2
  • Thank you for the incredible fast answer! That solved the issue! Commented Jan 29, 2017 at 14:19
  • In my case, I need to listen example.com:443 ssl;.
    – dibery
    Commented Jun 24, 2022 at 2:59
1

In my case I had edited my local /etc/hosts file to point the domain I was testing to a different server ip address which did not have that site enabled in the /etc/nginx/sites-enabled directory. Nginx served out a different website instead, and thus a different certificate.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .