CNAME Domain Forwarding and Let’s Encrypt SSL Certificates with Nginx

Though you have CNAME record to point sub2.sub1.domain1.com to the correct server, apache server maybe serving multiple website.

When a http request come in, apache check the URL against ServerName to determine which website to serve out. Should there be any additional name pointing to the same website, you put them in ServerAlias.

In your httpd.conf, you have to add ServerAlias for sub2.sub1.domain1.com

<VirtualHost *:80>
    ServerName sub1.domain.com
    ServerAlias sub2.sub1.domain1.com
    DocumentRoot /domain1/sub1/www
</VirtualHost>

Additionally, the first VirtualHost declaration in httpd.conf is used as the default. When a http request comes in and doesn't match any ServerName and ServerAlias, the default site is serve out.

If you are referring to other SSL settings than certificate / key, I would advice you to move their configuration to the http level in nginx configuration.

This way the settings will be inherited to every server block.

For example, in Debian and derivatives you can create /etc/nginx/conf.d/ssl.conf file, where you put these lines:

ssl_session_cache    shared:SSL:10m;
ssl_session_timeout  10m;

# Perfect Forward Security
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS +RC4 RC4";

The files inside conf.d are included in the http level.

default_server approach doesn't work here.

After this, the server blocks would look like this:

server {
    listen 443 default_server ssl;
    server_name _;

    ssl_certificate /path/to/certificate;
    ssl_certificate_key /path/to/key;
}

And, if you want to override some settings for some domains, then you can re-enter the directives in the server level.