I managed to configure a shared dedicated hosting on a single IP with nginx. Default HTTP and HTTPS serving a 404 for unknown domains incoming.
1 - Create a default zone
As nginx is loading vhosts in ascii order, you should create a 00-default file/symbolic link into your /etc/nginx/sites-enabled.
2 - Fill the default zone
Fill your 00-default with default vhosts. Here is the zone i am using:
server {
server_name _;
listen 80 default_server;
return 404;
}
server {
listen 443 ssl;
server_name _;
ssl_certificate /etc/nginx/ssl/nginx.crt;
ssl_certificate_key /etc/nginx/ssl/nginx.key;
return 404;
}
3 - Create self signed certif, test, and reload
You will need to create a self signed certificate into /etc/nginx/ssl/nginx.crt.
Create a default self signed certificate:
sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/nginx/ssl/nginx.key -out /etc/nginx/ssl/nginx.crt
Just a reminder:
- Test the nginx configuration before reloading/restarting :
nginx -t
- Reload a enjoy:
sudo service nginx reload
Hope it helps.
Best Answer
Yes.
Yes, when enabling Perfect Forward Secrecy. An appropriate ciphersuite must also be configured.
If a future attacker compromises your TLS, with PFS past traffic they intercepted and retained still cannot be decrypted.
Generate a DHE prime no smaller than your SSL certificate RSA private key. Given a 2048 bit private key:
Too little to worry about.
Google I/O 2014 had a good HTTPS Everwhere talk which covered these and related topics in a broad fashion.