# IPv6, HTTPS, and SNI **URL:** \ **Category:** NGINX\ **Created:** [December 7, 2015, 11:01am UTC](https://www.ruby-forum.com/t/ipv6-https-and-sni/243583 "2015-12-07T11:01:56Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Sadaf\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/858c86/32.png) [@Sadaf\_N](https://www.ruby-forum.com/u/Sadaf_N)\ **Post date:** [December 7, 2015, 11:01am UTC](https://www.ruby-forum.com/t/ipv6-https-and-sni/243583/1 "2015-12-07T11:01:56Z")
Hi, I am having in issue using https with multiple sites on ipv6 (nominally SNI). If I declare more than one listen directive for ipv6 on port 443 nginx refuses to start. The ipv4 configuration is fine, it’s only an issue with ipv6. Nginx details: nginx version: nginx/1.9.7 built by gcc 4.9.2 built with OpenSSL 1.0.1k 8 Jan 2015 TLS SNI support enabled Configuration looks like: server { listen 80 listen [::]:80; listen 443 ssl; listen [::]:443 ssl; server\_name my\_site.com; ssl\_certificate my\_site.com.crt; ssl\_certificate\_key my\_site.com.key; … } server { listen 80; listen [::]:80; listen 443 ssl; listen [::]:443 ssl; server\_name your\_site.com; ssl\_certificate your\_site.com.crt; ssl\_certificate\_key your\_site.com.key; … } Does anyone have an idea on why this might be occurring? In theory ipv6 shouldn’t make a difference, and it sure as heck doesn’t make a difference to the ipv4 configuration. ---
**Author:** ![Nikolai\_Lusan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/76d3ee/32.png) [@Nikolai\_Lusan](https://www.ruby-forum.com/u/Nikolai_Lusan)\ **Post date:** [December 7, 2015, 12:33pm UTC](https://www.ruby-forum.com/t/ipv6-https-and-sni/243583/2 "2015-12-07T12:33:03Z")
I seem to recall that with ipv6 you can’t mix 80 with 443 in one server configuration, but I might be wrong here. Posted at Nginx Forum: > **[Re: IPv6, HTTPS, and SNI](https://forum.nginx.org/read.php?2,263315,263317#msg-263317)** > > Hi, I am having in issue using https with multiple sites on ipv6 (nominally SNI). If I declare more than one listen directive for ipv6 on port 443 nginx refuses to start. The ipv4 configuration is fine, it's only an issue with ipv6. Nginx details: ---
**Author:** ![Nikolai\_Lusan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/76d3ee/32.png) [@Nikolai\_Lusan](https://www.ruby-forum.com/u/Nikolai_Lusan)\ **Post date:** [December 7, 2015, 1:16pm UTC](https://www.ruby-forum.com/t/ipv6-https-and-sni/243583/3 "2015-12-07T13:16:52Z")
Hi, > listen 80; Afaik this will make nginx listen to both IPv4 and IPv6 family. Specify the real IPv4 adress you want to listen to, to avoid the IPv6 bind. > listen [::]:80; This will make nginx to listen to both IPv6 and IPv4 family. Specify ipv6only=on [1] as a keyword to avoid the IPv4 bind. Same goes for 443/ssl. Imho, what you want is just listen to both address-families (without declaring IPv6): listen 80; listen 443 ssl; Regards, Lukas [1] [Module ngx\_http\_core\_module](http://nginx.org/en/docs/http/ngx_http_core_module.html#listen) ---
**Author:** ![Nikolai\_Lusan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/76d3ee/32.png) [@Nikolai\_Lusan](https://www.ruby-forum.com/u/Nikolai_Lusan)\ **Post date:** [December 7, 2015, 1:52pm UTC](https://www.ruby-forum.com/t/ipv6-https-and-sni/243583/4 "2015-12-07T13:52:30Z")
Hello! On Mon, Dec 07, 2015 at 08:00:40PM +1000, Nikolai Lusan wrote: > I am having in issue using https with multiple sites on ipv6 (nominally > SNI). If I declare more than one listen directive for ipv6 on port 443 > nginx refuses to start. The ipv4 configuration is fine, it’s only an > issue with ipv6. Please define “refuses to start”. It should print error details to stdout if startup fails for some reason, and will log anything to error log as well. – Maxim D. > **[nginx](http://nginx.org/)** ---
**Author:** ![Nikolai\_Lusan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/76d3ee/32.png) [@Nikolai\_Lusan](https://www.ruby-forum.com/u/Nikolai_Lusan)\ **Post date:** [December 7, 2015, 2:01pm UTC](https://www.ruby-forum.com/t/ipv6-https-and-sni/243583/5 "2015-12-07T14:01:16Z")
Hello! On Mon, Dec 07, 2015 at 01:16:06PM +0100, Lukas T. wrote: > > listen 80; > > Afaik this will make nginx listen to both IPv4 and IPv6 family. > > Specify the real IPv4 adress you want to listen to, to avoid the IPv6 bind. No, just a port means IPv4 wildcard address. > > listen [::]:80; > > This will make nginx to listen to both IPv6 and IPv4 family. > > Specify ipv6only=on [1] as a keyword to avoid the IPv4 bind. No, IPv6-and-IPv4 listen sockets will be created if and only if you’ll explicitly set the ipv6only parameter to off. (Before nginx 1.3.4, the operation system setting was used as a default for ipv6only. This was proven to be a wrong approach, and now nginx forces ipv6only=on by default. See [Module ngx\_http\_core\_module](http://nginx.org/r/listen) for some more details.) – Maxim D. > **[nginx](http://nginx.org/)** ---
**Author:** ![Nikolai\_Lusan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/76d3ee/32.png) [@Nikolai\_Lusan](https://www.ruby-forum.com/u/Nikolai_Lusan)\ **Post date:** [December 7, 2015, 2:14pm UTC](https://www.ruby-forum.com/t/ipv6-https-and-sni/243583/6 "2015-12-07T14:14:07Z")
Nikolai Lusan: > In theory ipv6 shouldn’t make a difference, and it sure as heck > doesn’t make a > difference to the ipv4 configuration. Maybe not what you expect/like to hear: Why does my head hurt if I run against a wall? → simply don’t do that. IPv6 is more then IPv4 with longer addresses. same here: generally there’s no need for SNI on IPv6 Take one address per service and you’re fine. Andreas ---
**Author:** ![Nikolai\_Lusan](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/76d3ee/32.png) [@Nikolai\_Lusan](https://www.ruby-forum.com/u/Nikolai_Lusan)\ **Post date:** [December 7, 2015, 2:01pm UTC](https://www.ruby-forum.com/t/ipv6-https-and-sni/243583/7 "2015-12-07T14:01:51Z")
Hello! On Mon, Dec 07, 2015 at 06:32:32AM -0500, itpp2012 wrote: > I seem to recall that with ipv6 you can’t mix 80 with 443 in one server > configuration, but I might be wrong here. You recall it incorrectly. – Maxim D. > **[nginx](http://nginx.org/)**