# Ignore broken SSL servers in config **URL:** \ **Category:** NGINX\ **Created:** [June 19, 2013, 8:07pm UTC](https://www.ruby-forum.com/t/ignore-broken-ssl-servers-in-config/235394 "2013-06-19T20:07:08Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![alcina](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/a587f6/32.png) [@alcina](https://www.ruby-forum.com/u/alcina)\ **Post date:** [June 19, 2013, 8:07pm UTC](https://www.ruby-forum.com/t/ignore-broken-ssl-servers-in-config/235394/1 "2013-06-19T20:07:08Z")
TL;DR: Any nginx setting to say ‘if a vhost’s ssl settings are broken, skip it and don’t fail to start’ ? I’ve certainly RTFM’d this and peered at the source, but I figured I might as well throw it out there, in case there’s some hidden setting I’ve missed. I’m building a reverse proxy config for thousands of SSL virtual hosts, to replace an apache solution. It very often happens that someone in support will make a mistake with regards to certs/keys. E.g. updating someone’s SSL cert but actually putting the CSR there instead. In apache, since the config is being generated out of mod\_perl, I can get around this situation by having mod\_perl do a modulus check on the cert and key and skip the vhost if they don’t match. In my case, I’d far prefer to have a missing vhost and have the other 1000 sites working, than all down. And, yes, I realize in default apache, it’d just fail to load. And also, yes, I realize asking something to ignore broken configs is a bit non-standard 🙂 Since I don’t have mod\_perl at my fingertips in nginx to perform a similar trick, the startup will just fail. So I was curious if there’s some obscure setting to tell nginx “if a vhost fails to loads its cert properly (or potentially any other vhost setting), skip it and continue loading the rest”? If such a thing did exist, I imagine that the configtest would have to turn errors for that vhost into warnings as well. My guess is obviously ‘no’, but I figured asking woud only cost me the time it takes to compose an email. ---
**Author:** ![mark](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e9c0ed/32.png) [@mark](https://www.ruby-forum.com/u/mark)\ **Post date:** [June 20, 2013, 11:01am UTC](https://www.ruby-forum.com/t/ignore-broken-ssl-servers-in-config/235394/2 "2013-06-20T11:01:35Z")
Hello! On Wed, Jun 19, 2013 at 11:06:19AM -0700, Mark M. wrote: > It very often happens that someone in support will make a mistake with > non-standard 🙂 > > My guess is obviously ‘no’, but I figured asking woud only cost me the time > it takes to compose an email. In nginx, there are two mechanism to deal with configuration errors: 1. On configuration reload nginx refuses to load a new configuration if there are errors (and continues to work with previously loaded correct configuration). 2. There is “nginx -t” to test configs. By using the two you are safe from a situation when a typo in configuration takes a service down (well, mostly: one always can take it down with a valid config). There is no kludge to magically apply only parts of a configuration though. – Maxim D. > **[nginx: donation](http://nginx.org/en/donation.html)** ---
**Author:** ![mark](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e9c0ed/32.png) [@mark](https://www.ruby-forum.com/u/mark)\ **Post date:** [June 20, 2013, 6:47pm UTC](https://www.ruby-forum.com/t/ignore-broken-ssl-servers-in-config/235394/3 "2013-06-20T18:47:17Z")
On Thu, Jun 20, 2013 at 2:00 AM, Maxim D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > might > > > If such a thing did exist, I imagine that the configtest would have to > > 1. On configuration reload nginx refuses to load a new Yup, that’s what I figured. Thanks for confirming.