# Nginx serving self-signed cert instead of the one defined in conf **URL:** \ **Category:** NGINX\ **Created:** [August 11, 2015, 7:27pm UTC](https://www.ruby-forum.com/t/nginx-serving-self-signed-cert-instead-of-the-one-defined-in-conf/242970 "2015-08-11T19:27:44Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Sadaf\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/858c86/32.png) [@Sadaf\_N](https://www.ruby-forum.com/u/Sadaf_N)\ **Post date:** [August 11, 2015, 7:27pm UTC](https://www.ruby-forum.com/t/nginx-serving-self-signed-cert-instead-of-the-one-defined-in-conf/242970/1 "2015-08-11T19:27:44Z")
Hello, I’m facing a strange issue since I upgraded from Nginx 1.6.2 to 1.8.0. My configuration files have been kept identicals, as well as my official SSL certificates. The problem is Nginx keeps on serving a self-signed certificate (dunno where it takes it from) instead of my proper certificates that I defined in the config file. Here’s the server section SSL config bits : * * * server { listen 443 ssl; ## listen for ipv4; this line is default and implied #listen [::]:80 default\_server ipv6only=on; ## listen for ipv6 server\_name my\_fqdn; ssl\_certificate /etc/nginx/ssl/gandi/my\_fqdn.crt; ssl\_certificate\_key /etc/nginx/ssl/gandi/my\_fqdn.key; ssl\_protocols TLSv1 TLSv1.1 TLSv1.2; ssl\_ciphers ‘AES256+EECDH:AES256+EDH’; ssl\_prefer\_server\_ciphers on; ssl\_session\_cache shared:SSL:10m; ## … This configuration works fine on my other server with nginx 1.6.2. I tried to increase error log to the debug level, but I get stricly no error message when starting Nginx (I was hoping for some clue like "nginx cannot read the file / path of the defined certs … but nothing). ## The config file checks is fine : ## sudo nginx -t nginx: the configuration file /etc/nginx/nginx.conf syntax is ok nginx: configuration file /etc/nginx/nginx.conf test is successful Example with openssl client : * * * ## openssl s\_client -connect myfqdn:443 CONNECTED(00000003) depth=0 C = EU, ST = NoWhere, O = Internet Widgits Pty Ltd, CN = myfqdn verify error:num=18:self signed certificate verify return:1 depth=0 C = EU, ST = NoWhere, O = Internet Widgits Pty Ltd, CN = myfqdn verify return:1 ## Certificate chain 0 s:/C=EU/ST=NoWhere/O=Internet Widgits Pty Ltd/CN=myfqdn i:/C=EU/ST=NoWhere/O=Internet Widgits Pty Ltd/CN=myfqdn ## Server certificate etc… I’m lost. Any help is welcomed ! Regards, Arno Posted at Nginx Forum: > **[Nginx serving self-signed cert instead of the one defined in conf](https://forum.nginx.org/read.php?2,260935,260935#msg-260935)** > > Hello, I'm facing a strange issue since I upgraded from Nginx 1.6.2 to 1.8.0. My configuration files have been kept identicals, as well as my official SSL certificates. The problem is Nginx keeps on serving a self-signed certificate (dunno where it... ---
**Author:** ![Arno0x0x](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/f475e1/32.png) [@Arno0x0x](https://www.ruby-forum.com/u/Arno0x0x)\ **Post date:** [August 11, 2015, 8:00pm UTC](https://www.ruby-forum.com/t/nginx-serving-self-signed-cert-instead-of-the-one-defined-in-conf/242970/2 "2015-08-11T20:00:28Z")
Hello! On Tue, Aug 11, 2015 at 01:27:23PM -0400, Arno0x0x wrote: > * * * > ssl\_prefer\_server\_ciphers on; > ssl\_session\_cache shared:SSL:10m; > > … * * * > This configuration works fine on my other server with nginx 1.6.2. The configuration snippet you’ve provided is just a snippet for a single server block, not a full configuration. Depending on other server{} blocks it may or may not work. Most notably, the “listen” directive doesn’t have “default\_server” parameter. That is, if there is another server{} block defined for the same listening socket in the configuration, it may be used as a default one instead (assuming that server is defined first). Try looking into your full configuration, nginx.conf. When questions arise, it usally means that the configuration contains something like “include /path/to/files/\*.conf;” - and you have to examine all files matching a given mask. – Maxim D. > **[nginx](http://nginx.org/)** ---
**Author:** ![Arno0x0x](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/f475e1/32.png) [@Arno0x0x](https://www.ruby-forum.com/u/Arno0x0x)\ **Post date:** [August 11, 2015, 8:22pm UTC](https://www.ruby-forum.com/t/nginx-serving-self-signed-cert-instead-of-the-one-defined-in-conf/242970/3 "2015-08-11T20:22:06Z")
Hi Maxim, Thanks for your answer. Alas ! I check all config files in my /etc/nginx directory, there’s only one containing the server{} directive (for the sake of it, I added the default\_server to the listen directive, but it doesn’t change anything) : * * * pi@rpi /etc/nginx $ grep -r server \* fastcgi.conf:fastcgi\_param SERVER\_PROTOCOL $server\_protocol; fastcgi.conf:fastcgi\_param SERVER\_ADDR $server\_addr; fastcgi.conf:fastcgi\_param SERVER\_PORT $server\_port; fastcgi.conf:fastcgi\_param SERVER\_NAME $server\_name; scgi\_params:scgi\_param SERVER\_PROTOCOL $server\_protocol; scgi\_params:scgi\_param SERVER\_PORT $server\_port; scgi\_params:scgi\_param SERVER\_NAME $server\_name; sites-available/myfqdn:# server { sites-available/myfqdn:server { sites-available/myfqdn: listen 443 ssl default\_server; ## listen for ipv4; this line is default and implied sites-available/lmyfqdn: #listen [::]:80 default\_server ipv6only=on; ## listen for ipv6 sites-available/myfqdn: server\_name myfqdn; sites-available/myfqdn: ssl\_prefer\_server\_ciphers on; sites-available/myfqdn: # redirect server error pages to the static page /50x.html uwsgi\_params:uwsgi\_param SERVER\_PROTOCOL $server\_protocol; uwsgi\_params:uwsgi\_param SERVER\_PORT $server\_port; uwsgi\_params:uwsgi\_param SERVER\_NAME $server\_name; * * * Could it be possible that nginx reads some other config files from another location than /etc/nginx ? What are my other options (some more debug info would be useful to check where nginx gets its config from). any idea ? Thanks Arno Posted at Nginx Forum: [http://forum.nginx.org/read.php?2,260935,260942#msg-260942](http://forum.nginx.org/read.php?2,260935,260942#msg-260942) ---
**Author:** ![Arno0x0x](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/f475e1/32.png) [@Arno0x0x](https://www.ruby-forum.com/u/Arno0x0x)\ **Post date:** [August 12, 2015, 11:57am UTC](https://www.ruby-forum.com/t/nginx-serving-self-signed-cert-instead-of-the-one-defined-in-conf/242970/4 "2015-08-12T11:57:30Z")
For the record: problem solved. SHAME on me !! The problem was simply that I copied the wrong certificates from my old installation (nginx 1.6.2) to the new one (nginx 1.8.0). As often, the problem lies in front of the keyboard 🙂 Thanks Maxim for your assistance in any case, I learnt a few things on the way. Regards, Arno Posted at Nginx Forum: > **[Re: Nginx serving self-signed cert instead of the one defined in conf](https://forum.nginx.org/read.php?2,260935,260957#msg-260957)** > > Hello, I'm facing a strange issue since I upgraded from Nginx 1.6.2 to 1.8.0. My configuration files have been kept identicals, as well as my official SSL certificates. The problem is Nginx keeps on serving a self-signed certificate (dunno where it...