1

I'm using Nginx Apache Reverse Proxy, I have multiple VHOSTS and I want to serve them all in a single nginx vhost file with support for SSL.

My server block is

    server {
    listen 80;
    server_name _;

    root   /var/www/$host/web;


    access_log  /var/log/mylogs/httpd/$host/access.log; 

    location / {
        try_files $uri $uri/ /index.php;
    }

    location ~ \.php$ {
        proxy_pass http://SERVERIP:8090;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location ~ /\. {
        deny all;
    }


}

This is working well without SSL for all sites BUT when I do the same for SSL support below:

    server {
    listen 80;
    server_name _;

    ssl on;
    ssl_certificate /var/www/$host/ssl/$host-le.crt;
    ssl_certificate_key /var/www/$host/ssl/$host-le.key;
    root   /var/www/$host/web;


    access_log  /var/log/mylogs/httpd/$host/access.log; 

    location / {
        try_files $uri $uri/ /index.php;
    }

    location ~ \.php$ {
        proxy_pass http://MYIP:8090;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location ~ /\. {
        deny all;
    }

}

I got errors something like this

ssl_certificate /var/www/$host/ssl/$host-le.crt not found
nginx config test failed

My vhost web files are in this format

/var/www/domain1.com/web /var/www/domain2.com/web /var/www/domain3.com/web

and their ssl cert and keys are in

/var/www/domain1.com/ssl /var/www/domain2.com/ssl /var/www/domain3.com/ssl

Please help me, I'm noob and still learning....

  • Have a look at this stackoverflow.com/questions/15414810/…. $host variable will contain the first server that is defined in your server block which is the value that server_name holds. This is not going to work for multiple domains the way you've configured nginx – Valentin Bajrami Oct 9 '17 at 9:20
  • Thanks for reply, Can I use $http_host instead? – Dark9Y8 Oct 9 '17 at 9:25
  • 1
    No I don't think that works. The server_name doesn't resolve to the static name of your virtual web folder. Maybe this explains a bit better: drupal.org/node/1544144 – Valentin Bajrami Oct 9 '17 at 9:36
  • Take a look at openresty-reference.readthedocs.io/en/latest/Directives/… This requires nginx patching or using OpenResty – Alexey Ten Oct 9 '17 at 16:02
  • Sounds like a hack. Where are the good old days when SSL certificates were read with root privileges which were dropped afterwards? Without knowing your business case and other requirements... what about one certificate for all domains? Certificates can be valid for multiple domains by listing them in their subject alternate name section. Let's encrypt supports up to 100 SAN entries. – blafasel Oct 9 '17 at 19:51
0

Use $ssl_server_name variable instead of $host.
It can be used since Nginx 1.15.9 and OpenSSL 1.0.2 version. http://nginx.org/ru/docs/http/ngx_http_ssl_module.html

ssl_certificate     $ssl_server_name.crt;
ssl_certificate_key $ssl_server_name.key;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.