0

I have a problem - regarding nginx - that manual reading and searching the web couldn't solve. (The following systems has been handed over to me out of the blue and the configuration is "a bit" messy but there is hardly documented anything. So i'm digging into all the manuals and the smoothing and consolidating is going quite well except for my question as follows.)

Situation: We have a reverse proxy server "forwarding" two servers with lets-encrypt certificates using nginx.

reverse proxy: RP, IP: IP#1 1st server: S1, domainX.com, IP: IP#2, certificate: certX 2nd server: S2, sub.domainY.com, IP: IP#3, certificate: certY

The main RP-nginx configuration incl. ssl configuration for S2 is in /etc/nginx/nginx.conf, while S1-ssl configuration and both (S1+S2) "server" configurations are in /etc/nginx/vhosts.d/S1.conf and /etc/nginx/vhosts.d/S2.conf:

nginx.conf excerpt:

http {
    ssl_protocols   TLSv1.2 TLSv1.3;
    ssl_dhparam     /etc/nginx/ssl/dhparam.pem;

    ssl_certificate /etc/nginx/ssl/S2/S2Chained.pem;
    ssl_certificate_key /etc/nginx/ssl/S2/S2TlsCert.key;

    ssl_prefer_server_ciphers   on;
    ssl_session_cache   shared:SSL:20m;
    ssl_session_timeout 60m;
    ssl_ecdh_curve auto;
}
server { some standard cases e.g.
    listen      IP#1:443 ssl default_server;
        server_name "";
        access_log  /var/log/nginx/access.default_server_SSL.log  main;
    return 444;

        location / {
            root   /srv/www/htdocs/;
            index  index.html index.htm;
        }

        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   /srv/www/htdocs/;
        }
    }
}

domainX.conf excerpt:

server {
    listen      IP#1:443 ssl;
    server_name sub1.domainX.com;

    ssl_certificate     /etc/nginx/ssl/S1/S1Chained.pem;
    ssl_certificate_key /etc/nginx/ssl/S1/S1TlsCert.key;

    access_log  /var/log/nginx/access.domainX_SSL.log  main;

    location / {
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass      https://IP#2:443;
    }
}
server {
    listen      IP#1:443 ssl;
    server_name sub2.domainX.com;

    ssl_certificate     /etc/nginx/ssl/S1/S1Chained.pem;
    ssl_certificate_key /etc/nginx/ssl/S1/S1TlsCert.key;

    access_log  /var/log/nginx/access.domainX_SSL.log  main;

    location / {
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass      https://IP#2:443;
    }
}

subdomainY.conf excerpt:

server {
    listen      IP#1:443 ssl;
    server_name sub.domainY.com;

    access_log  /var/log/nginx/access.subdomainY_SSL.log  main;

    location / {
        client_max_body_size 0;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass https://IP#3:443;
    }
}

This configuration is working, both https-paths are fine and the certs are correctly delivered.

Now i delete

  • ssl_certificate /etc/nginx/ssl/S2/S2Chained.pem;
  • ssl_certificate_key /etc/nginx/ssl/S2/S2TlsCert.key;

from nginx.conf and add these two lines into subdomainY.conf:

nginx.conf excerpt (not working):

http {
    ssl_protocols   TLSv1.2 TLSv1.3;
    ssl_dhparam     /etc/nginx/ssl/dhparam.pem;

    ssl_prefer_server_ciphers   on;
    ssl_session_cache   shared:SSL:20m;
    ssl_session_timeout 60m;
    ssl_ecdh_curve auto;
}
server { some standard cases e.g.
    listen      IP#1:443 ssl default_server;
        server_name "";
        access_log  /var/log/nginx/access.default_server_SSL.log  main;
    return 444;

        location / {
            root   /srv/www/htdocs/;
            index  index.html index.htm;
        }

        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   /srv/www/htdocs/;
        }
    }
}

subdomainY.conf excerpt (not working):

server {
    listen      IP#1:443 ssl;
    server_name sub.domainY.com;

    ssl_certificate     /etc/nginx/ssl/S2/S2Chained.pem;
    ssl_certificate_key /etc/nginx/ssl/S2/S2TlsCert.key;

    access_log  /var/log/nginx/access.subdomainY_SSL.log  main;

    location / {
        client_max_body_size 0;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass https://IP#3:443;
    }
}

Now the configuration isn't working anymore and both domains are unreachable.

If i change back everything is ok.

And what is working, too:

nginx.conf excerpt (working again):

http {
    ssl_protocols   TLSv1.2 TLSv1.3;
    ssl_dhparam     /etc/nginx/ssl/dhparam.pem;

    ssl_certificate /etc/nginx/ssl/S2/S2Chained.pem;
    ssl_certificate_key /etc/nginx/ssl/S2/S2TlsCert.key;

    ssl_prefer_server_ciphers   on;
    ssl_session_cache   shared:SSL:20m;
    ssl_session_timeout 60m;
    ssl_ecdh_curve auto;
}
server { some standard cases e.g.
    listen      IP#1:443 ssl default_server;
        server_name "";
        access_log  /var/log/nginx/access.default_server_SSL.log  main;
    return 444;

        location / {
            root   /srv/www/htdocs/;
            index  index.html index.htm;
        }

        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   /srv/www/htdocs/;
        }
    }
}

subdomainY.conf excerpt (working again):

server {
    listen      IP#1:443 ssl;
    server_name sub.domainY.com;

    ssl_certificate     /etc/nginx/ssl/S2/S2Chained.pem;
    ssl_certificate_key /etc/nginx/ssl/S2/S2TlsCert.key;

    access_log  /var/log/nginx/access.subdomainY_SSL.log  main;

    location / {
        client_max_body_size 0;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass https://IP#3:443;
    }
}

So a minimum change of shifting lines between documents has that large impact. That lines are no where else referenced.

Any ideas in which direction i shall turn my search?

  • server_name ""; I don't see how this makes sense over ssl... unless you would have a top level wildcard certificate... And I really doubt it'll ever exist. – Antony Gibbs Feb 6 '18 at 23:39
  • Thanks for your reply. Sad to say the config doesn't make sence in some more places. But yesterday i solved the problem and actually wildcard certificate was part of it (i will answer myself later on). – Nightshift Feb 7 '18 at 12:05
0

I solved the problem myself, by taking a step back. So I saw I was lured in the wrong direction by the following script lines:

nginx.conf excerpt:

http {
    ssl_certificate /etc/nginx/ssl/S2/S2Chained.pem;
    ssl_certificate_key /etc/nginx/ssl/S2/S2TlsCert.key;
}

As these lines relate to the subdomainY.conf I thought the problem was here, but I was just misguided by that.

Stepping back means to read again the manual. The answer to my question was in here: https://nginx.org/en/docs/http/configuring_https_servers.html#certificate_with_several_names

domainX.com has 2 subdomains and both are defined by the certificate. And in that case "It is better to place a certificate file with several names and its private key file at the http level of configuration to inherit their single memory copy in all servers:" [see link above].

So the certicifate path at http level actually is best pratice - but the config linked to the wrong certificate (I don't even know how this could even work). The solution was to alter those paths to the domainX.com certificate and to change the two other config files accordingly.

nginx.conf excerpt (solved)

http {
    ssl_protocols   TLSv1.2 TLSv1.3;
    ssl_dhparam     /etc/nginx/ssl/dhparam.pem;

    ssl_certificate /etc/nginx/ssl/S1/S1Chained.pem;
    ssl_certificate_key /etc/nginx/ssl/S1/S1TlsCert.key;

    ssl_prefer_server_ciphers   on;
    ssl_session_cache   shared:SSL:20m;
    ssl_session_timeout 60m;
    ssl_ecdh_curve auto;
}

domainX.com excerpt (solved)

server {
    listen      IP#1:443 ssl;
    server_name sub1.domainX.com;

    access_log  /var/log/nginx/access.domainX_SSL.log  main;

    location / {
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass      https://IP#2:443;
    }
}
server {
    listen      IP#1:443 ssl;
    server_name sub2.domainX.com;

    access_log  /var/log/nginx/access.domainX_SSL.log  main;

    location / {
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass      https://IP#2:443;
    }
}

sub.domainY.com excerpt (solved)

server {
    listen      IP#1:443 ssl;
    server_name sub.domainY.com;

    ssl_certificate     /etc/nginx/ssl/S2/S2Chained.pem;
    ssl_certificate_key /etc/nginx/ssl/S2/S2TlsCert.key;

    access_log  /var/log/nginx/access.subdomainY_SSL.log  main;

    location / {
        client_max_body_size 0;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass https://IP#3:443;
    }
}
  • btw, IP#1:443 ssl http2; ads http2 support :) – Antony Gibbs Feb 8 '18 at 9:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.