# Multiple server definitions with SSL **URL:** \ **Category:** NGINX\ **Created:** [July 26, 2011, 6:45pm UTC](https://www.ruby-forum.com/t/multiple-server-definitions-with-ssl/209932 "2011-07-26T18:45:36Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![luislavena](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/0ea827/32.png) [@luislavena](https://www.ruby-forum.com/u/luislavena)\ **Post date:** [July 26, 2011, 6:45pm UTC](https://www.ruby-forum.com/t/multiple-server-definitions-with-ssl/209932/1 "2011-07-26T18:45:36Z")
We recently had a problem where we created a new server configuration (for http with and without ssl on ports 443 and 80 respectively) on a shared web server which also included a number of other nginx servers similarly configured. Unfortunately, we neglected to include the ssl\_certificate and ssl\_certificate\_key directives for the new server. So, the configurations looked something like this: # START CONFIG # Pre-existing, working server definition (one of several) server { listen 80; listen 443 ssl; server\_name [first.example.com](http://first.example.com); ssl\_certificate /path/to/ssl.crt ssl\_certificate\_key /path/to/key.crt # snip } # New server definition server { listen 80 listen 443 ssl; server\_name [second.example.com](http://second.example.com); # snip } # END CONFIG Now, prior to restarting the nginx process, we issued “nginx -t” to test the new configuration - everything passed. Once the nginx service was restarted, however, the old, working site failed to respond to https requests (cURL said "Unknown SSL protocol error in connection to [first.example.com:443](http://first.example.com:443) "), even though the configuration for that particular server was unchanged. I’ve since added a default SSL server to my config, which seems to fix this problem incase ssl\_certificate\_\* lines get missed in future (there was no server with “listen 443 ssl default” prior to that). We’re running Ubuntu 10.04 LTS x86\_64 with Nginx 1.0.0 stable from PPA: $ nginx -V nginx: nginx version: nginx/1.0.0 nginx: TLS SNI support enabled nginx: configure arguments: --conf-path=/etc/nginx/nginx.conf –error-log-path=/var/log/nginx/error.log –http-client-body-temp-path=/var/lib/nginx/body –http-fastcgi-temp-path=/var/lib/nginx/fastcgi –http-log-path=/var/log/nginx/access.log –http-proxy-temp-path=/var/lib/nginx/proxy –http-scgi-temp-path=/var/lib/nginx/scgi –http-uwsgi-temp-path=/var/lib/nginx/uwsgi –lock-path=/var/lock/nginx.lock --pid-path=/var/run/nginx.pid –with-debug --with-http\_addition\_module --with-http\_dav\_module –with-http\_geoip\_module --with-http\_gzip\_static\_module –with-http\_image\_filter\_module --with-http\_realip\_module –with-http\_stub\_status\_module --with-http\_ssl\_module –with-http\_sub\_module --with-http\_xslt\_module --with-ipv6 –with-sha1=/usr/include/openssl --with-md5=/usr/include/openssl –with-mail --with-mail\_ssl\_module –add-module=/build/buildd/nginx-1.0.0/debian/modules/nginx-echo –add-module=/build/buildd/nginx-1.0.0/debian/modules/nginx-upstream-fair Is this expected behaviour? Should nginx -t not have flagged that there was no default ssl\_certificate(\_key) directives defined? Why was the first server affected? ---
**Author:** ![Ben\_Lancaster](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/f07891/32.png) [@Ben\_Lancaster](https://www.ruby-forum.com/u/Ben_Lancaster)\ **Post date:** [July 26, 2011, 8:13pm UTC](https://www.ruby-forum.com/t/multiple-server-definitions-with-ssl/209932/2 "2011-07-26T20:13:15Z")
Hello! On Tue, Jul 26, 2011 at 05:44:32PM +0100, Ben Lancaster wrote: > We recently had a problem where we created a new server > configuration (for http with and without ssl on ports 443 and 80 > respectively) on a shared web server which also included a > number of other nginx servers similarly configured. > > Unfortunately, we neglected to include the ssl\_certificate and > ssl\_certificate\_key directives for the new server. So, the > configurations looked something like this: […] > Is this expected behaviour? Should nginx -t not have flagged > that there was no default ssl\_certificate(\_key) directives > defined? Probably yes, but this isn’t currently done when you define ssl servers with ``` listen ... ssl; ``` Using “ssl on;” in separate server definition will give you expected config test error. > Why was the first server affected? Most likely because you used something like “include /path/to/files/\*;” to include individual config files, and new server you added was picked up first and become default one. Maxim D. ---
**Author:** ![Ben\_Lancaster](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/f07891/32.png) [@Ben\_Lancaster](https://www.ruby-forum.com/u/Ben_Lancaster)\ **Post date:** [July 28, 2011, 11:36am UTC](https://www.ruby-forum.com/t/multiple-server-definitions-with-ssl/209932/3 "2011-07-28T11:36:54Z")
Hello! On Thu, Jul 28, 2011 at 10:55:11AM +0400, Igor S. wrote: > > > Unfortunately, we neglected to include the ssl\_certificate and > > > ssl servers with > > > > ``` > > listen ... ssl; > > > > ``` > > > > Using “ssl on;” in separate server definition will give you > > expected config test error. > > I’m going to decprecate “ssl on” directive in favour of “listen … ssl”, > since SSL is rather a port option, but not server one. > The initial “ssl on” was inspired by Apache 1.3. > Apache’s “Listen … https” appeared in somewhere in 2005. Ok, so should we add config parsing time ssl\_certificate checks to it then? Or, alternatively, drop this checks altogether assuming there are aNULL ciphers to be used or other SNI-based servers with certificates defined? Both should resolve the problem as specified in original message. I personally think the latter looks more promising. Maxim D. ---
**Author:** ![Ben\_Lancaster](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/f07891/32.png) [@Ben\_Lancaster](https://www.ruby-forum.com/u/Ben_Lancaster)\ **Post date:** [July 28, 2011, 8:55am UTC](https://www.ruby-forum.com/t/multiple-server-definitions-with-ssl/209932/4 "2011-07-28T08:55:43Z")
On Tue, Jul 26, 2011 at 10:12:43PM +0400, Maxim D. wrote: > > ssl\_certificate\_key directives for the new server. So, the > > ``` > listen ... ssl; > > ``` > > Using “ssl on;” in separate server definition will give you > expected config test error. I’m going to decprecate “ssl on” directive in favour of “listen … ssl”, since SSL is rather a port option, but not server one. The initial “ssl on” was inspired by Apache 1.3. Apache’s “Listen … https” appeared in somewhere in 2005. – Igor S.