Nginx defaults to first config when using 301












0















I have a dedicated server with several websites running with their own (sub)domains. These have their own vhost config file for nginx, which is the webserver I'm using. They all have LetsEncrypt certificates, which is running fine, and :80 gets a return 301 https://$server_name$request_uri.



I'm now trying to debug why SSL Labs report that I have two certificates attached to a domain I'm testing. It turns out that doing a openssl s_client -connect <domain name>:443 reports that it's getting the first (alphabetically) website enabled, and not the actual website I'm testing. I have tested this by disabling the first website, and it goes straight to the next in the folder.



How do I solve this, so nginx doesn't default back to whatever comes first in the sites-enabled-folder, but rather sticks to the server it's set to initially? Is there a setting in nginx that I haven't set? Or am I using the 301 incorrectly?



Here's a config example:



server {

    listen 80;

    server_name example.com www.example.com;



    ## Enforce https

    return 301 https://$server_name$request_uri;

}



server {

    listen 443 ssl http2;

    server_name example.com www.example.com;

    ...

    ssl_certificate         /etc/letsencrypt/live/example.com/fullchain.pem;

    ssl_certificate_key     /etc/letsencrypt/live/example.com/privkey.pem;

    ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;

    ...

}





ssl nginx







share|improve this question




















  • 1





    I'm not sure whenever the openssl call supports SNI. If it doesn't it might be an explanation for your problem. If there is no server name in the request nginx will take the default configuration. One option would be to have an IP for each site.

    – Seth
    Jan 8 at 13:30













  • So this is a SNI issue? I can do openssl s_client -servername example.com -connect example.com:443, and it returns the correct cert. But aren't I bummed anyway, no matter what config gets the default_server? Won't all non-SNI requests whimper about a non-matching cert anyway?

    – moso
    Jan 8 at 13:45











  • Most browsers support SNI but even without SSL not having SNI will be a problem. If you don't have SNI and have multiple sites configured on one IP you will always hit the default site. If you do have a direct match for IP to name the cert wouldn't be a problem because you would deliver a single cert for that site.

    – Seth
    Jan 9 at 6:19
















0















I have a dedicated server with several websites running with their own (sub)domains. These have their own vhost config file for nginx, which is the webserver I'm using. They all have LetsEncrypt certificates, which is running fine, and :80 gets a return 301 https://$server_name$request_uri.



I'm now trying to debug why SSL Labs report that I have two certificates attached to a domain I'm testing. It turns out that doing a openssl s_client -connect <domain name>:443 reports that it's getting the first (alphabetically) website enabled, and not the actual website I'm testing. I have tested this by disabling the first website, and it goes straight to the next in the folder.



How do I solve this, so nginx doesn't default back to whatever comes first in the sites-enabled-folder, but rather sticks to the server it's set to initially? Is there a setting in nginx that I haven't set? Or am I using the 301 incorrectly?



Here's a config example:



server {

    listen 80;

    server_name example.com www.example.com;



    ## Enforce https

    return 301 https://$server_name$request_uri;

}



server {

    listen 443 ssl http2;

    server_name example.com www.example.com;

    ...

    ssl_certificate         /etc/letsencrypt/live/example.com/fullchain.pem;

    ssl_certificate_key     /etc/letsencrypt/live/example.com/privkey.pem;

    ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;

    ...

}





ssl nginx







share|improve this question




















  • 1





    I'm not sure whenever the openssl call supports SNI. If it doesn't it might be an explanation for your problem. If there is no server name in the request nginx will take the default configuration. One option would be to have an IP for each site.

    – Seth
    Jan 8 at 13:30













  • So this is a SNI issue? I can do openssl s_client -servername example.com -connect example.com:443, and it returns the correct cert. But aren't I bummed anyway, no matter what config gets the default_server? Won't all non-SNI requests whimper about a non-matching cert anyway?

    – moso
    Jan 8 at 13:45











  • Most browsers support SNI but even without SSL not having SNI will be a problem. If you don't have SNI and have multiple sites configured on one IP you will always hit the default site. If you do have a direct match for IP to name the cert wouldn't be a problem because you would deliver a single cert for that site.

    – Seth
    Jan 9 at 6:19














0












0








0








I have a dedicated server with several websites running with their own (sub)domains. These have their own vhost config file for nginx, which is the webserver I'm using. They all have LetsEncrypt certificates, which is running fine, and :80 gets a return 301 https://$server_name$request_uri.



I'm now trying to debug why SSL Labs report that I have two certificates attached to a domain I'm testing. It turns out that doing a openssl s_client -connect <domain name>:443 reports that it's getting the first (alphabetically) website enabled, and not the actual website I'm testing. I have tested this by disabling the first website, and it goes straight to the next in the folder.



How do I solve this, so nginx doesn't default back to whatever comes first in the sites-enabled-folder, but rather sticks to the server it's set to initially? Is there a setting in nginx that I haven't set? Or am I using the 301 incorrectly?



Here's a config example:



server {

    listen 80;

    server_name example.com www.example.com;



    ## Enforce https

    return 301 https://$server_name$request_uri;

}



server {

    listen 443 ssl http2;

    server_name example.com www.example.com;

    ...

    ssl_certificate         /etc/letsencrypt/live/example.com/fullchain.pem;

    ssl_certificate_key     /etc/letsencrypt/live/example.com/privkey.pem;

    ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;

    ...

}





ssl nginx







share|improve this question
















I have a dedicated server with several websites running with their own (sub)domains. These have their own vhost config file for nginx, which is the webserver I'm using. They all have LetsEncrypt certificates, which is running fine, and :80 gets a return 301 https://$server_name$request_uri.



I'm now trying to debug why SSL Labs report that I have two certificates attached to a domain I'm testing. It turns out that doing a openssl s_client -connect <domain name>:443 reports that it's getting the first (alphabetically) website enabled, and not the actual website I'm testing. I have tested this by disabling the first website, and it goes straight to the next in the folder.



How do I solve this, so nginx doesn't default back to whatever comes first in the sites-enabled-folder, but rather sticks to the server it's set to initially? Is there a setting in nginx that I haven't set? Or am I using the 301 incorrectly?



Here's a config example:



server {

    listen 80;

    server_name example.com www.example.com;



    ## Enforce https

    return 301 https://$server_name$request_uri;

}



server {

    listen 443 ssl http2;

    server_name example.com www.example.com;

    ...

    ssl_certificate         /etc/letsencrypt/live/example.com/fullchain.pem;

    ssl_certificate_key     /etc/letsencrypt/live/example.com/privkey.pem;

    ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;

    ...

}





ssl nginx




ssl nginx






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited Jan 8 at 13:04







moso

















asked Jan 8 at 12:53









mosomoso

12




12








  • 1





    I'm not sure whenever the openssl call supports SNI. If it doesn't it might be an explanation for your problem. If there is no server name in the request nginx will take the default configuration. One option would be to have an IP for each site.

    – Seth
    Jan 8 at 13:30













  • So this is a SNI issue? I can do openssl s_client -servername example.com -connect example.com:443, and it returns the correct cert. But aren't I bummed anyway, no matter what config gets the default_server? Won't all non-SNI requests whimper about a non-matching cert anyway?

    – moso
    Jan 8 at 13:45











  • Most browsers support SNI but even without SSL not having SNI will be a problem. If you don't have SNI and have multiple sites configured on one IP you will always hit the default site. If you do have a direct match for IP to name the cert wouldn't be a problem because you would deliver a single cert for that site.

    – Seth
    Jan 9 at 6:19














  • 1





    I'm not sure whenever the openssl call supports SNI. If it doesn't it might be an explanation for your problem. If there is no server name in the request nginx will take the default configuration. One option would be to have an IP for each site.

    – Seth
    Jan 8 at 13:30













  • So this is a SNI issue? I can do openssl s_client -servername example.com -connect example.com:443, and it returns the correct cert. But aren't I bummed anyway, no matter what config gets the default_server? Won't all non-SNI requests whimper about a non-matching cert anyway?

    – moso
    Jan 8 at 13:45











  • Most browsers support SNI but even without SSL not having SNI will be a problem. If you don't have SNI and have multiple sites configured on one IP you will always hit the default site. If you do have a direct match for IP to name the cert wouldn't be a problem because you would deliver a single cert for that site.

    – Seth
    Jan 9 at 6:19








1




1





I'm not sure whenever the openssl call supports SNI. If it doesn't it might be an explanation for your problem. If there is no server name in the request nginx will take the default configuration. One option would be to have an IP for each site.

– Seth
Jan 8 at 13:30







I'm not sure whenever the openssl call supports SNI. If it doesn't it might be an explanation for your problem. If there is no server name in the request nginx will take the default configuration. One option would be to have an IP for each site.

– Seth
Jan 8 at 13:30















So this is a SNI issue? I can do openssl s_client -servername example.com -connect example.com:443, and it returns the correct cert. But aren't I bummed anyway, no matter what config gets the default_server? Won't all non-SNI requests whimper about a non-matching cert anyway?

– moso
Jan 8 at 13:45





So this is a SNI issue? I can do openssl s_client -servername example.com -connect example.com:443, and it returns the correct cert. But aren't I bummed anyway, no matter what config gets the default_server? Won't all non-SNI requests whimper about a non-matching cert anyway?

– moso
Jan 8 at 13:45













Most browsers support SNI but even without SSL not having SNI will be a problem. If you don't have SNI and have multiple sites configured on one IP you will always hit the default site. If you do have a direct match for IP to name the cert wouldn't be a problem because you would deliver a single cert for that site.

– Seth
Jan 9 at 6:19





Most browsers support SNI but even without SSL not having SNI will be a problem. If you don't have SNI and have multiple sites configured on one IP you will always hit the default site. If you do have a direct match for IP to name the cert wouldn't be a problem because you would deliver a single cert for that site.

– Seth
Jan 9 at 6:19










0






active

oldest

votes











Your Answer








StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});














draft saved

draft discarded


















StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1391869%2fnginx-defaults-to-first-config-when-using-301%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown

























0






active

oldest

votes








0






active

oldest

votes









active

oldest

votes






active

oldest

votes
















draft saved

draft discarded




















































Thanks for contributing an answer to Super User!


  • Please be sure to answer the question. Provide details and share your research!

But avoid …



  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.


To learn more, see our tips on writing great answers.




draft saved


draft discarded














StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1391869%2fnginx-defaults-to-first-config-when-using-301%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown





















































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown

































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown







-

Popular posts from this blog

Probability when a professor distributes a quiz and homework assignment to a class of n students.

Image
0 0 $begingroup$ Need help with this problem. Suppose our lazy professor collects a quiz and a homework assignment from a class of n students one day, then distributes both the quizzes and the homework assignments back to the class in a random fashion for grading. Each student receives one quiz and one homework assignment to grade. (a) What is the probability that every student receives someone else's quiz to grade, and someone else's homework to grade? (b) What is the probability that no student receives both their own quiz and their own homework assignment to grade? In this case, some students may receive their own quiz, and others may receive their own homework assignment. (c) Compute the limiting probability as n approaches infinity in each case. ...
Read more

Aardman Animations

Image
Aardman Animations, Ltd. Aardman Animations Tipo privada Atividade Animação em stop-motion , Animação em CGI Fundação 1972 Fundador(es) Peter Lord David Sproxton Sede Bristol, Inglaterra  Reino Unido Proprietário(s) Dreamworks Pessoas-chave Peter Lord David Sproxton Nick Park Divisões Aardman Features Aardman Digital Aardman Commercials Aardman Broadcast Aardman International Aardman Rights Aardman Effects Aardman 3-D Systems Aardman Nathan Love AardBoiled Website oficial aardman.com ...
Read more

Are they similar matrix

Image
0 $begingroup$ Do $begin{bmatrix} 0&i&0\0&0&1\0&0&0 end{bmatrix} $ and $begin{bmatrix} 0&0&0\-i&0&0\0&1&0 end{bmatrix} $ are similar.Is this True/false Clearly both are nilpotent and one is conjucate transpose of other but how to know if they are similar.i'm stuck. Please help me linear-algebra vector-spaces eigenvalues-eigenvectors generalizedeigenvector share | cite | improve this question edited Dec 10 '18 at 6:38 Vasanth Kris asked Dec 10 '18 at 6:19 ...
Read more