Nginx – Issue serving multiple SSL certs via nginx

nginxssl

I've got two domains both with SSL certs on one nginx instance. I'm trying to redirect http to https and removing www hostname on both domains i.e. http://www.site1.com redirects to https://site1.com

What I've got at the moment, http://site1.com redirects fine and issues the correct cert, however http://www.site1.com issues the SSL cert from site2.com and doesn't redirect without www. site2 works fine for all redirects and issues teh correct certs. I think it has to do with me using "default" in the SSL config for site2, however if I remove it both sites then return connection refused errors.

Here's the configs

/etc/nginx/sites-available/site1

upstream site1.com {
    server unix:/home/site1.com/site1.com.sock;
}


server {
  listen 80;
  server_name site1.com www.site1.com;
  return 301 https://site1.com$request_uri;
}

server {
    listen 443 ssl;
    server_name www.site1.com;
    return 301 https://site1.com$request_uri;
}


server {
    listen 80;
    server_name site1.com;

    # SSL configuration

    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    include snippets/ssl-site1.com.conf;

/etc/nginx/sites-available/site2

upstream site2 {
    server unix:/home/site2/site2.sock;
}


server {
  listen 80;
  server_name site2.com www.site2.com site2.co.uk www.site2.co.uk;
  return 301 https://site2.com$request_uri;
}

server {
    listen 443 ssl;
    server_name www.site2.com;
    return 301 https://site2.com$request_uri;
}


server {
    listen 80;
    server_name site2.com;

    # SSL configuration

    listen 443 ssl default http2;
    listen [::]:443 ssl default http2;
    include snippets/ssl-site2.com.conf;
    include snippets/ssl-params.conf;

Best Answer

You do not have certificates defined for the www.site1.com and www.site2.com server blocks so nginx is probably using whichever certificate was loaded first in the configuration.

Your certificates are presumably defined in the snippets/ssl-site1.com.conf and snippets/ssl-site2.com.conf files.

Assuming that your certificates are valid for the www. variant of the domain name, those statements need to be included in the other server blocks.

For example:

server {
    listen 443 ssl;
    server_name www.site1.com;
    include snippets/ssl-site1.com.conf;
    return 301 https://site1.com$request_uri;
}
Related Topic