Setup: I have an nginx client which is sending a HTTPS request to an nginx origin server.

I have been doing my research on how the directive 'proxy_ssl_name' can be used to overwrite the SNI. According to the nginx official documentation, the default value used by 'proxy_ssl_name' is $proxy_host.

In my case, the value of $proxy_host is the name of upstream server block ('ups_server'). I can see that 'ups_server' is being sent as the SNI from my client server. I am not able to understand how the origin server is sending the right certificate back to my client when it receives an SNI that doesn't match with any of the supported domain names.

Can someone please help me understand this?

  • Doesvthe origin server have multiple certificates? – Gerard H. Pille Sep 7 '18 at 3:14
  • Yes. The origin server has multiple certificates – sank Sep 7 '18 at 23:45

Origin server sends the default server block certificate if no server block matches the SNI.

  • Thanks. I found that origin server is sending the default server's certificate. My default server block should have returned 404. But the weird part is, after establishing HTTPS connection using the default server's certificate, Nginx is serving content from the server block whose hostname is equal to the host header. – sank Sep 7 '18 at 23:48
  • These things will happen when you don't have exactly specified of all used hostnames with both http (listen 80;) and https (listen 443;). I also recommend having a default_server block for both http and https, where you either return 404 (http) or 444 (https). By explicitly specifying all of this, you don't need to try to interpret why a certain virtual host is selected. – Tero Kilkanen Sep 8 '18 at 10:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.