Nginx defaults to first config when using 301
I have a dedicated server with several websites running with their own (sub)domains. These have their own vhost config file for nginx, which is the webserver I'm using. They all have LetsEncrypt certificates, which is running fine, and :80 gets a return 301 https://$server_name$request_uri.
I'm now trying to debug why SSL Labs report that I have two certificates attached to a domain I'm testing. It turns out that doing a openssl s_client -connect <domain name>:443 reports that it's getting the first (alphabetically) website enabled, and not the actual website I'm testing. I have tested this by disabling the first website, and it goes straight to the next in the folder.
How do I solve this, so nginx doesn't default back to whatever comes first in the sites-enabled-folder, but rather sticks to the server it's set to initially? Is there a setting in nginx that I haven't set? Or am I using the 301 incorrectly?
Here's a config example:
server {
listen 80;
server_name example.com www.example.com;
## Enforce https
return 301 https://$server_name$request_uri;
}
server {
listen 443 ssl http2;
server_name example.com www.example.com;
...
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;
...
}
ssl nginx
asked Jan 8 at 12:53
mosomoso
12
add a comment |
I have a dedicated server with several websites running with their own (sub)domains. These have their own vhost config file for nginx, which is the webserver I'm using. They all have LetsEncrypt certificates, which is running fine, and :80 gets a return 301 https://$server_name$request_uri.
I'm now trying to debug why SSL Labs report that I have two certificates attached to a domain I'm testing. It turns out that doing a openssl s_client -connect <domain name>:443 reports that it's getting the first (alphabetically) website enabled, and not the actual website I'm testing. I have tested this by disabling the first website, and it goes straight to the next in the folder.
How do I solve this, so nginx doesn't default back to whatever comes first in the sites-enabled-folder, but rather sticks to the server it's set to initially? Is there a setting in nginx that I haven't set? Or am I using the 301 incorrectly?
Here's a config example:
server {
listen 80;
server_name example.com www.example.com;
## Enforce https
return 301 https://$server_name$request_uri;
}
server {
listen 443 ssl http2;
server_name example.com www.example.com;
...
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;
...
}
ssl nginx
asked Jan 8 at 12:53
mosomoso
12
1
I'm not sure whenever the openssl call supports SNI. If it doesn't it might be an explanation for your problem. If there is no server name in the request nginx will take the default configuration. One option would be to have an IP for each site.
– Seth
Jan 8 at 13:30
So this is a SNI issue? I can doopenssl s_client -servername example.com -connect example.com:443, and it returns the correct cert. But aren't I bummed anyway, no matter what config gets thedefault_server? Won't all non-SNI requests whimper about a non-matching cert anyway?
– moso
Jan 8 at 13:45
Most browsers support SNI but even without SSL not having SNI will be a problem. If you don't have SNI and have multiple sites configured on one IP you will always hit the default site. If you do have a direct match for IP to name the cert wouldn't be a problem because you would deliver a single cert for that site.
– Seth
Jan 9 at 6:19
add a comment |
I have a dedicated server with several websites running with their own (sub)domains. These have their own vhost config file for nginx, which is the webserver I'm using. They all have LetsEncrypt certificates, which is running fine, and :80 gets a return 301 https://$server_name$request_uri.
I'm now trying to debug why SSL Labs report that I have two certificates attached to a domain I'm testing. It turns out that doing a openssl s_client -connect <domain name>:443 reports that it's getting the first (alphabetically) website enabled, and not the actual website I'm testing. I have tested this by disabling the first website, and it goes straight to the next in the folder.
How do I solve this, so nginx doesn't default back to whatever comes first in the sites-enabled-folder, but rather sticks to the server it's set to initially? Is there a setting in nginx that I haven't set? Or am I using the 301 incorrectly?
Here's a config example:
server {
listen 80;
server_name example.com www.example.com;
## Enforce https
return 301 https://$server_name$request_uri;
}
server {
listen 443 ssl http2;
server_name example.com www.example.com;
...
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;
...
}
ssl nginx
asked Jan 8 at 12:53
mosomoso
12
I have a dedicated server with several websites running with their own (sub)domains. These have their own vhost config file for nginx, which is the webserver I'm using. They all have LetsEncrypt certificates, which is running fine, and :80 gets a return 301 https://$server_name$request_uri.
I'm now trying to debug why SSL Labs report that I have two certificates attached to a domain I'm testing. It turns out that doing a openssl s_client -connect <domain name>:443 reports that it's getting the first (alphabetically) website enabled, and not the actual website I'm testing. I have tested this by disabling the first website, and it goes straight to the next in the folder.
How do I solve this, so nginx doesn't default back to whatever comes first in the sites-enabled-folder, but rather sticks to the server it's set to initially? Is there a setting in nginx that I haven't set? Or am I using the 301 incorrectly?
Here's a config example:
server {
listen 80;
server_name example.com www.example.com;
## Enforce https
return 301 https://$server_name$request_uri;
}
server {
listen 443 ssl http2;
server_name example.com www.example.com;
...
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;
...
}
ssl nginx
ssl nginx
asked Jan 8 at 12:53
mosomoso
12
asked Jan 8 at 12:53
mosomoso
12
edited Jan 8 at 13:04
moso
asked Jan 8 at 12:53
mosomoso
12
asked Jan 8 at 12:53
mosomoso
12
asked Jan 8 at 12:53
mosomoso
12
12
1
I'm not sure whenever the openssl call supports SNI. If it doesn't it might be an explanation for your problem. If there is no server name in the request nginx will take the default configuration. One option would be to have an IP for each site.
– Seth
Jan 8 at 13:30
So this is a SNI issue? I can doopenssl s_client -servername example.com -connect example.com:443, and it returns the correct cert. But aren't I bummed anyway, no matter what config gets thedefault_server? Won't all non-SNI requests whimper about a non-matching cert anyway?
– moso
Jan 8 at 13:45
Most browsers support SNI but even without SSL not having SNI will be a problem. If you don't have SNI and have multiple sites configured on one IP you will always hit the default site. If you do have a direct match for IP to name the cert wouldn't be a problem because you would deliver a single cert for that site.
– Seth
Jan 9 at 6:19
add a comment |
1
I'm not sure whenever the openssl call supports SNI. If it doesn't it might be an explanation for your problem. If there is no server name in the request nginx will take the default configuration. One option would be to have an IP for each site.
– Seth
Jan 8 at 13:30
So this is a SNI issue? I can doopenssl s_client -servername example.com -connect example.com:443, and it returns the correct cert. But aren't I bummed anyway, no matter what config gets thedefault_server? Won't all non-SNI requests whimper about a non-matching cert anyway?
– moso
Jan 8 at 13:45
Most browsers support SNI but even without SSL not having SNI will be a problem. If you don't have SNI and have multiple sites configured on one IP you will always hit the default site. If you do have a direct match for IP to name the cert wouldn't be a problem because you would deliver a single cert for that site.
– Seth
Jan 9 at 6:19
1
1
I'm not sure whenever the openssl call supports SNI. If it doesn't it might be an explanation for your problem. If there is no server name in the request nginx will take the default configuration. One option would be to have an IP for each site.
– Seth
Jan 8 at 13:30
I'm not sure whenever the openssl call supports SNI. If it doesn't it might be an explanation for your problem. If there is no server name in the request nginx will take the default configuration. One option would be to have an IP for each site.
– Seth
Jan 8 at 13:30
So this is a SNI issue? I can do
openssl s_client -servername example.com -connect example.com:443, and it returns the correct cert. But aren't I bummed anyway, no matter what config gets the default_server? Won't all non-SNI requests whimper about a non-matching cert anyway?– moso
Jan 8 at 13:45
So this is a SNI issue? I can do
openssl s_client -servername example.com -connect example.com:443, and it returns the correct cert. But aren't I bummed anyway, no matter what config gets the default_server? Won't all non-SNI requests whimper about a non-matching cert anyway?– moso
Jan 8 at 13:45
Most browsers support SNI but even without SSL not having SNI will be a problem. If you don't have SNI and have multiple sites configured on one IP you will always hit the default site. If you do have a direct match for IP to name the cert wouldn't be a problem because you would deliver a single cert for that site.
– Seth
Jan 9 at 6:19
Most browsers support SNI but even without SSL not having SNI will be a problem. If you don't have SNI and have multiple sites configured on one IP you will always hit the default site. If you do have a direct match for IP to name the cert wouldn't be a problem because you would deliver a single cert for that site.
– Seth
Jan 9 at 6:19
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1391869%2fnginx-defaults-to-first-config-when-using-301%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1391869%2fnginx-defaults-to-first-config-when-using-301%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
I'm not sure whenever the openssl call supports SNI. If it doesn't it might be an explanation for your problem. If there is no server name in the request nginx will take the default configuration. One option would be to have an IP for each site.
– Seth
Jan 8 at 13:30
So this is a SNI issue? I can do
openssl s_client -servername example.com -connect example.com:443, and it returns the correct cert. But aren't I bummed anyway, no matter what config gets thedefault_server? Won't all non-SNI requests whimper about a non-matching cert anyway?– moso
Jan 8 at 13:45
Most browsers support SNI but even without SSL not having SNI will be a problem. If you don't have SNI and have multiple sites configured on one IP you will always hit the default site. If you do have a direct match for IP to name the cert wouldn't be a problem because you would deliver a single cert for that site.
– Seth
Jan 9 at 6:19