# Setup multiple SSL servers in one config

**URL:** <https://www.ruby-forum.com/t/setup-multiple-ssl-servers-in-one-config/167745>\
**Category:** NGINX\
**Created:** [May 12, 2009, 7:39am UTC](https://www.ruby-forum.com/t/setup-multiple-ssl-servers-in-one-config/167745 "2009-05-12T07:39:27Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jonathan\_Garvin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/898d66/32.png) [@Jonathan\_Garvin](https://www.ruby-forum.com/u/Jonathan_Garvin)\
**Post date:** [May 12, 2009, 7:39am UTC](https://www.ruby-forum.com/t/setup-multiple-ssl-servers-in-one-config/167745/1 "2009-05-12T07:39:27Z")

</div>

I’m in the process of trying to convert a Pound config file that manages  
multiple SSL sites over to Nginx. If I just have one site setup in the  
nginx.conf file then everything, including the SSL, works fine. But if I  
add a second server block for a different domain, then the second tries  
to use the SSL certificate for the first, resulting in the browser  
raising security warnings. My conf file is below. Any hints at what I  
am doing wrong would be greatly appreciated.

* * *

user wwidea;  
worker\_processes 1;

events {  
worker\_connections 1024;  
}

http {  
include mime.types;  
default\_type application/octet-stream;  
passenger\_root /usr/local/lib/ruby/gems/1.8/gems/passenger-2.2.2;  
passenger\_ruby /usr/local/bin/ruby;  
passenger\_max\_pool\_size 20;  
passenger\_pool\_idle\_time 3600;

```
sendfile on;
gzip on;
keepalive_timeout 65;

server {
    listen 443;
    server_name www.domain1.com;
    root /var/rails/domain1/current/public;

    ssl on;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_redirect false;
    proxy_max_temp_file_size 0;
    ssl_certificate /var/ssl-certs/domain1.cert;
    ssl_certificate_key /var/ssl-certs/domain1.key;
    index index.html index.htm;
    passenger_enabled on;
}

server {
    listen 443;
    server_name www.domain2.com;
    root /var/rails/domain2/current/public;

    ssl on;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_redirect false;
    proxy_max_temp_file_size 0;
    ssl_certificate /var/ssl-certs/domain2.cert;
    ssl_certificate_key /var/ssl-certs/domain2.key;
    index index.html index.htm;
    passenger_enabled on;
}

```

}

---

<div class="post-metadata">

**Author:** ![Jonathan\_Garvin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/898d66/32.png) [@Jonathan\_Garvin](https://www.ruby-forum.com/u/Jonathan_Garvin)\
**Post date:** [May 12, 2009, 8:01am UTC](https://www.ruby-forum.com/t/setup-multiple-ssl-servers-in-one-config/167745/2 "2009-05-12T08:01:42Z")

</div>

On Mon, May 11, 2009 at 05:57:10PM -0600, Jonathan Garvin wrote:

> I’m in the process of trying to convert a Pound config file that manages  
> multiple SSL sites over to Nginx. If I just have one site setup in the  
> nginx.conf file then everything, including the SSL, works fine. But if I  
> add a second server block for a different domain, then the second tries  
> to use the SSL certificate for the first, resulting in the browser  
> raising security warnings. My conf file is below. Any hints at what I  
> am doing wrong would be greatly appreciated.

[http://httpd.apache.org/docs/2.0/ssl/ssl\_faq.html#vhosts](http://httpd.apache.org/docs/2.0/ssl/ssl_faq.html#vhosts)  
[http://wiki.cacert.org/wiki/VhostTaskForce](http://wiki.cacert.org/wiki/VhostTaskForce)

---

<div class="post-metadata">

**Author:** ![Jonathan\_Garvin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/898d66/32.png) [@Jonathan\_Garvin](https://www.ruby-forum.com/u/Jonathan_Garvin)\
**Post date:** [May 12, 2009, 5:09pm UTC](https://www.ruby-forum.com/t/setup-multiple-ssl-servers-in-one-config/167745/3 "2009-05-12T17:09:45Z")

</div>

On Tue, May 12, 2009 at 08:54:50AM -0600, Jon G. wrote:

> Thanks Igor,  
> Are you saying that a single instance Nginx cannot handle multiple  
> sites with different SSL certificates? The environment I’m trying to  
> emulate is working just fine with Pound right now. In other words, one  
> instance of pound is running on my server that handles multiple SSL  
> certificates for multiple live domains (working like this for several  
> years). Seems to me if Pound can handle the task, Nginx ought to be  
> able to as well. Is the only option to run Pound in front of Nginx so  
> that Pound can handle the SSL before passing the traffic off to Nginx?  
> I was hoping to eliminate Pound from the equation all together.

No, a single nginx instance can handle several SSL sites, but you need  
several IP, one per each SSL host. Or you may use some workarounds as  
decribed here  
[VhostTaskForce - CAcert Wiki](http://wiki.cacert.org/wiki/VhostTaskForce)

---

<div class="post-metadata">

**Author:** ![Jonathan\_Garvin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/898d66/32.png) [@Jonathan\_Garvin](https://www.ruby-forum.com/u/Jonathan_Garvin)\
**Post date:** [May 12, 2009, 5:00pm UTC](https://www.ruby-forum.com/t/setup-multiple-ssl-servers-in-one-config/167745/4 "2009-05-12T17:00:20Z")

</div>

Thanks Igor,  
Are you saying that a single instance Nginx cannot handle multiple  
sites with different SSL certificates? The environment I’m trying to  
emulate is working just fine with Pound right now. In other words, one  
instance of pound is running on my server that handles multiple SSL  
certificates for multiple live domains (working like this for several  
years). Seems to me if Pound can handle the task, Nginx ought to be  
able to as well. Is the only option to run Pound in front of Nginx so  
that Pound can handle the SSL before passing the traffic off to Nginx?  
I was hoping to eliminate Pound from the equation all together.

Igor S. wrote:

> > 
> 
> [SSL/TLS Strong Encryption: FAQ - Apache HTTP Server](http://httpd.apache.org/docs/2.0/ssl/ssl_faq.html#vhosts)  
> [VhostTaskForce - CAcert Wiki](http://wiki.cacert.org/wiki/VhostTaskForce)

–

[http://www.5valleys.com/](http://www.5valleys.com/)

[http://www.workingwithrails.com/person/8078](http://www.workingwithrails.com/person/8078)

---

<div class="post-metadata">

**Author:** ![Jonathan\_Garvin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/898d66/32.png) [@Jonathan\_Garvin](https://www.ruby-forum.com/u/Jonathan_Garvin)\
**Post date:** [May 12, 2009, 5:52pm UTC](https://www.ruby-forum.com/t/setup-multiple-ssl-servers-in-one-config/167745/5 "2009-05-12T17:52:54Z")

</div>

Igor S. wrote:

> > able to as well. Is the only option to run Pound in front of Nginx so  
> > that Pound can handle the SSL before passing the traffic off to Nginx?  
> > I was hoping to eliminate Pound from the equation all together.
> 
> No, a single nginx instance can handle several SSL sites, but you need  
> several IP, one per each SSL host. Or you may use some workarounds as  
> decribed here  
> [VhostTaskForce - CAcert Wiki](http://wiki.cacert.org/wiki/VhostTaskForce)

Yes. we have multiple IPs. As I said this is working now with Pound.  
I’m just having trouble figuring out how to configure Nginx to handle  
this.

Oh, wait. I just noticed that the ‘listen’ directive can take an  
address as well as a port. duh. So, my guess now is that instead of  
‘listen 443’, I need to say ‘listen x.x.x.x:443’, in each server block.  
right?

> > > > to use the SSL certificate for the first, resulting in the browser  
> > > > –
> > 
> > [http://www.5valleys.com/](http://www.5valleys.com/)
> > 
> > [http://www.workingwithrails.com/person/8078](http://www.workingwithrails.com/person/8078)

–

[http://www.5valleys.com/](http://www.5valleys.com/)

[http://www.workingwithrails.com/person/8078](http://www.workingwithrails.com/person/8078)

---

<div class="post-metadata">

**Author:** ![Jonathan\_Garvin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/898d66/32.png) [@Jonathan\_Garvin](https://www.ruby-forum.com/u/Jonathan_Garvin)\
**Post date:** [May 12, 2009, 6:01pm UTC](https://www.ruby-forum.com/t/setup-multiple-ssl-servers-in-one-config/167745/6 "2009-05-12T18:01:44Z")

</div>

On Tue, May 12, 2009 at 09:45:03AM -0600, Jon G. wrote:

> > > years). Seems to me if Pound can handle the task, Nginx ought to be
> 
> Yes. we have multiple IPs. As I said this is working now with Pound.  
> I’m just having trouble figuring out how to configure Nginx to handle this.
> 
> Oh, wait. I just noticed that the ‘listen’ directive can take an  
> address as well as a port. duh. So, my guess now is that instead of  
> ‘listen 443’, I need to say ‘listen x.x.x.x:443’, in each server block.  
> right?

Yes.