# SNI support for nginx

**URL:** <https://www.ruby-forum.com/t/sni-support-for-nginx/244891>\
**Category:** NGINX\
**Created:** [July 4, 2016, 12:31pm UTC](https://www.ruby-forum.com/t/sni-support-for-nginx/244891 "2016-07-04T12:31:22Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sadaf\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/858c86/32.png) [@Sadaf\_N](https://www.ruby-forum.com/u/Sadaf_N)\
**Post date:** [July 4, 2016, 12:31pm UTC](https://www.ruby-forum.com/t/sni-support-for-nginx/244891/1 "2016-07-04T12:31:22Z")

</div>

Hi,

I am relatively new to nginx.  
I would like to setup multiple domains on the same port. Nginx has SNI  
support enabled.  
Do i have to still point to the right ssl certificate and ssl private in  
each of server blocks using the ssl\_certificate directive?  
Or is there a way, nginx will be able to dynamically figure out the cert  
to  
be presented without it being explicitly mentioned via the directive  
ssl\_certificate?

Posted at Nginx Forum:

> **[SNI support for nginx](https://forum.nginx.org/read.php?2,268024,268024#msg-268024)**
>
> Hi, I am relatively new to nginx. I would like to setup multiple domains on the same port. Nginx has SNI support enabled. Do i have to still point to the right ssl certificate and ssl private in each of server blocks using the ssl\_certificate...

---

<div class="post-metadata">

**Author:** ![sushma](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/f04885/32.png) [@sushma](https://www.ruby-forum.com/u/sushma)\
**Post date:** [July 4, 2016, 1:21pm UTC](https://www.ruby-forum.com/t/sni-support-for-nginx/244891/2 "2016-07-04T13:21:02Z")

</div>

* * *

nginx mailing list  
removed\_email\_address@domain.invalid  
[http://mailman.nginx.org/mailman/listinfo/nginx](http://mailman.nginx.org/mailman/listinfo/nginx)

---

<div class="post-metadata">

**Author:** ![sushma](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/f04885/32.png) [@sushma](https://www.ruby-forum.com/u/sushma)\
**Post date:** [July 4, 2016, 1:19pm UTC](https://www.ruby-forum.com/t/sni-support-for-nginx/244891/3 "2016-07-04T13:19:16Z")

</div>

Hello!

On Mon, Jul 04, 2016 at 06:31:02AM -0400, Sushma wrote:

> I am relatively new to nginx.  
> I would like to setup multiple domains on the same port. Nginx has SNI  
> support enabled.  
> Do i have to still point to the right ssl certificate and ssl private in  
> each of server blocks using the ssl\_certificate directive?

Yes.

> Or is there a way, nginx will be able to dynamically figure out the cert to  
> be presented without it being explicitly mentioned via the directive  
> ssl\_certificate?

No.

–  
Maxim D.

> **[nginx](http://nginx.org/)**

---

<div class="post-metadata">

**Author:** ![sushma](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/f04885/32.png) [@sushma](https://www.ruby-forum.com/u/sushma)\
**Post date:** [July 6, 2016, 8:58am UTC](https://www.ruby-forum.com/t/sni-support-for-nginx/244891/4 "2016-07-06T08:58:47Z")

</div>

On 07/04/2016 12:31 PM, Sushma wrote:

> Or is there a way, nginx will be able to dynamically figure out the cert to  
> be presented without it being explicitly mentioned via the directive  
> ssl\_certificate?

After some research not statically by configuration. But using a bit of  
lua could offer a way to maybe make this happen. Something like:  
[https://litespeed.io/dynamic-tls-certificates-with-openresty-and-ssl\_certificate\_by\_lua/](https://litespeed.io/dynamic-tls-certificates-with-openresty-and-ssl_certificate_by_lua/)

Regards

Christian

---

<div class="post-metadata">

**Author:** ![sushma](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/f04885/32.png) [@sushma](https://www.ruby-forum.com/u/sushma)\
**Post date:** [July 7, 2016, 7:55am UTC](https://www.ruby-forum.com/t/sni-support-for-nginx/244891/5 "2016-07-07T07:55:39Z")

</div>

Hello!

On Tue, Jul 5, 2016 at 11:57 PM, Christian Rohmann wrote:

> On 07/04/2016 12:31 PM, Sushma wrote:
> 
> > Or is there a way, nginx will be able to dynamically figure out the cert to  
> > be presented without it being explicitly mentioned via the directive  
> > ssl\_certificate?
> 
> After some research not statically by configuration. But using a bit of  
> lua could offer a way to maybe make this happen. Something like:

[https://litespeed.io/dynamic-tls-certificates-with-openresty-and-ssl\_certificate\_by\_lua/](https://litespeed.io/dynamic-tls-certificates-with-openresty-and-ssl_certificate_by_lua/)

> 

Aye. CloudFlare, for example, has been using ssl\_certificate\_by\_lua\*  
with the ngx.ssl Lua module to lazily load a _lot_ of SSL certificates  
and private keys from remote services (via nonblocking IO) only on  
demand in its global SSL gateway network for long. With lazy loading  
and local caching (via lua\_shared\_dict and/or lua-resty-lrucache), the  
flexibility and performance can be both excellent. You can not only  
look up your SSL credentials via SNI, but also via the server IP  
address the client is accessing (for older SSL clients that do not  
support TLS SNI).

The formal documentation for this feature is:

```
https://github.com/openresty/lua-nginx-module/#ssl_certificate_by_lua_block

https://github.com/openresty/lua-resty-core/blob/master/lib/ngx/ssl.md#readme

```

Even dynamic OCSP stapling is supported 😉

The easiest way to get everything setup is to use the OpenResty bundle  
BTW:

```
http://openresty.org/en/

```

Have fun!

Best regards,  
-agentzh