0

I have one site and the configuration for that named mysite.com. Config's below.

server {

        listen 1.2.3.4:80;
        listen 1.2.3.4:443 default ssl;

        server_name mysite.com;

        ssl_certificate /etc/nginx/ssl/wildcard_cert.com.crt;
        ssl_certificate_key /etc/nginx/ssl/wildcard_key.com.key;

        add_header X-Cache-Status $upstream_cache_status;
        proxy_cache off;

        if ($allowed_country = no) {
            return 444;
        }

        include include/locations.conf;

}

Also, in the file locations.conf I have the reverse proxy rules. It's below.

location / {
                include proxy_params;
                proxy_pass http://mysite-on-IIS;
        }

It works fine.

I got the assignment to configure the same non-SSL site. For that I createad a new IP for linux's interface where Nginx installed. See /etc/network/interfaces file below.

auto eth1
iface eth1 inet static
        address 1.2.3.4
        netmask 255.255.255.240

auto eth1
iface eth1 inet static
        address 1.2.3.5
        netmask 255.255.255.240

And I created a new configuration file named mysite.ir (non-SSL, because our provider doesn't support SSL for Iran). The configuration file is the same as mysite.com. I copypasted it and just deleted SSL lines. See it below.

server {

        listen 1.2.3.5:80;

        server_name mysite.ir;

        add_header X-Cache-Status $upstream_cache_status;
        proxy_cache off;

        if ($allowed_country = no) {
            return 444;
        }

        include include/locations.conf;

}

If I go to mysite.com – everything is working. If I go to mysite.ir – I see default Nginx greeting instead my site specyfyed in proxy. Even if I changing IP in mysite.ir file to IP from mysite.com – it's working properly too. If I go to site by IP from mysite.com or mysite.ir I see default Nginx greeting.

I don't understand why.

5
  • Why would you create a new IP? Nginx can listen for http and https on the same IP, same or different domain name. It can listen on different ones too, of course. Assume Nginx has been restarted? Please edit your question to include curl to new site and corresponding access / error logs. – Tim Mar 12 '17 at 18:42
  • Are you sure that Nginx can listen on the same or different domain? I wrote "why" in the first answer with proofs. I encountered with a problem. Nginx put certificate for mysite.com if I force type https://mysite.ir and browser throws me "Connection is not secure" error because certificates names mismatch (.ir and .com). – Max Muravyev Mar 13 '17 at 8:57
  • Do you have valid certificates installed for both domains? – Tero Kilkanen Mar 13 '17 at 9:08
  • I have certificate installed only for one domain named mysite.com (wildcard *.mysite.com). I don't have a certificate for mysite.ir because our provides doesn't support certificates for .ir (Iran) domains. We have all https redirect everywhere except mysite.ir but if I type https://mysite.ir I see the error in browser, click proceed and only then redirect works. – Max Muravyev Mar 13 '17 at 9:51
  • Re comment above, my server has one IP address and hosts five https sites with their matching http sites. This requires SNI which the very oldest browsers don't support, but the vast majority do. I'll let go that 1% of traffic to reduce the need for scarce IP addresses. – Tim Mar 13 '17 at 17:53
0

How critical is it to be running these sites from two different NICs? I'd suggest just creating one server configuration block for https (include 443 listener and and SSL configuration) and another block for http traffic (port 80, no certs)

Then just forward both to the correct upstream and just set:

server {  
  listen 80 default_server;  
  server_name _;  
  add_header X-Cache-Status $upstream_cache_status;  
  proxy_cache off;  
  location / {  
    include proxy_params;  
    if ($allowed_country = no) { return 444; }  
    proxy_pass http://mysite-on-IIS;   
    proxy_set_header Host $host;  
    proxy_set_header X-Forwarded-For $remote_addr;  
  }
}
4
  • I used this way initially. But there is one problem. If I go to site without https and specify https://mysite.ir then Nginx add certificate from another site named mysite.com and browser shows me SSL-privacy warning with red background. More about this. – Max Muravyev Mar 13 '17 at 8:28
  • Just the copypaste. With this configuration a browser receives the default server’s certificate, i.e. www.example.com regardless of the requested server name. This is caused by SSL protocol behaviour. The SSL connection is established before the browser sends an HTTP request and nginx does not know the name of the requested server. Therefore, it may only offer the default server’s certificate. – Max Muravyev Mar 13 '17 at 8:29
  • Either your nginx or client is ancient. SSL feature called Server Name Indication (SNI) tells nginx which host name is going to be accessed, and therefore nginx can select the correct virtual host. SNI has been implemented for years now. – Tero Kilkanen Mar 13 '17 at 9:07
  • For the https copy of your config I would suggest setting server_name to valid value (ie. whatever lines up to your certs. Although, I'm not sure what NGINX will try to do if you access it on a port that is listening for another domain name and it doesn't have any certificate at all for the one requested. I suspect that it would pass whichever certificate it has, but you could also probably open up the NGINX docs on ssl to sort that out. – hvindin Mar 13 '17 at 9:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.