# SSL & Nginx **URL:** \ **Category:** NGINX\ **Created:** [January 3, 2011, 11:22am UTC](https://www.ruby-forum.com/t/ssl-nginx/201225 "2011-01-03T11:22:52Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![luislavena](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/0ea827/32.png) [@luislavena](https://www.ruby-forum.com/u/luislavena)\ **Post date:** [January 3, 2011, 11:22am UTC](https://www.ruby-forum.com/t/ssl-nginx/201225/1 "2011-01-03T11:22:52Z")
Hello, First let me wish everybody a very good and healthy 2011! We are using nginx for loadbalancing multiple websites. Almost every website has SSL enabled. We have one upstream for a couple of websites: #start webservers: upstream webservers-fair { fair; server 213.154.235.247 max\_fails=5 fail\_timeout=20s weight=1; server 213.154.235.248 max\_fails=5 fail\_timeout=20s weight=1; } #end upstream The upstream needed is provided in the config, here is the problem. We use the config IP multiple times with different certificates and different server\_name variables. Last Friday weve noticed that the certificate wasnt working well in IE7/8/9. Is this a known problem or am I doing something wrong? server { listen xxx.xxx.xxx.249:80; server\_name domain.nl; server\_name domain.nl; #logs access\_log /var/log/nginx/lb1-webservers.access.log; error\_log /var/log/nginx/lb1-webservers.error.log; ``` location / { proxy_pass http://webservers-fair; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For ``` $proxy\_add\_x\_forwarded\_for; proxy\_redirect off; proxy\_max\_temp\_file\_size 0; client\_max\_body\_size 30M; } ``` location /status { stub_status on; access_log off; } }#end server ``` server { listen xxx.xxx.xxx.249:443; server\_name domain.nl; server\_name domain.nl; #logs access\_log /var/log/nginx/lb1-webservers.access.log; error\_log /var/log/nginx/lb1-webservers.error.log; ``` ssl on; ssl_certificate /certificates/ssl/domain-nl.crt; ssl_certificate_key /certificates/ssl/domain-nl.key; ssl_session_timeout 5m; ssl_protocols SSLv2 SSLv3 TLSv1; ssl_ciphers ``` ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP; ssl\_prefer\_server\_ciphers on; ``` location / { proxy_pass http://webservers-fair; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For ``` $proxy\_add\_x\_forwarded\_for; proxy\_redirect off; proxy\_max\_temp\_file\_size 0; client\_max\_body\_size 30M; } ``` location /status-ssl { stub_status on; access_log off; } }#end server ``` ########################### WEBSERVER ############################################### Help is much appreciated!! Grt Jaap van Arragon ---
**Author:** ![Jaap\_van\_Arragon](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/b2d939/32.png) [@Jaap\_van\_Arragon](https://www.ruby-forum.com/u/Jaap_van_Arragon)\ **Post date:** [January 3, 2011, 11:30am UTC](https://www.ruby-forum.com/t/ssl-nginx/201225/2 "2011-01-03T11:30:24Z")
SSL & NginxHi, > The upstream needed is provided in the config, here is the problem. We use > the config IP multiple times with different certificates and different > server\_name variables. Last Friday we’ve noticed that the certificate wasn’t > working well in IE7/8/9. Is this a known problem or am I doing something > wrong? > **[Server Name Indication](https://en.wikipedia.org/wiki/Server_Name_Indication)** > > Server Name Indication (SNI) is an extension to Transport Layer Security (TLS) where a client indicates which hostname it is attempting to connect to at the start of the handshaking process. The extension allows a server to present one of multiple possible certificates on the same IP address and port number, allowing for multiple services (including HTTPS websites) to be served by the same IP address without using a single certificate. For HTTPS, it is the conceptual equivalent to HTTP/1.1 vi Pr... TL;DR: Your setup doesn’t work for clients that use Windows XP, but it works for clients that use Windows Vista or 7. If you want SSL to work for everybody, then you need to use separate IP address for each certificate. Best regards, Piotr S. \< [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) \> ---
**Author:** ![Jaap\_van\_Arragon](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/b2d939/32.png) [@Jaap\_van\_Arragon](https://www.ruby-forum.com/u/Jaap_van_Arragon)\ **Post date:** [January 3, 2011, 1:14pm UTC](https://www.ruby-forum.com/t/ssl-nginx/201225/3 "2011-01-03T13:14:34Z")
Ahh oke that explains a lot. We will change the config to separate ip addresses. Thank you. Regards, Jaap On 1/3/11 11:29 AM, “Piotr S.” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > SSL & NginxHi, > The upstream needed is provided in the config, here is the > problem. We use > the config IP multiple times with different certificates > and different > server\_name variables. Last Friday weve noticed that the > certificate wasnt > working well in IE7/8/9. Is this a known problem or am I > doing something > > wrong? > **[Server Name Indication](https://en.wikipedia.org/wiki/Server_Name_Indication)** > > Server Name Indication (SNI) is an extension to Transport Layer Security (TLS) where a client indicates which hostname it is attempting to connect to at the start of the handshaking process. The extension allows a server to present one of multiple possible certificates on the same IP address and port number, allowing for multiple services (including HTTPS websites) to be served by the same IP address without using a single certificate. For HTTPS, it is the conceptual equivalent to HTTP/1.1 vi Pr... TL;DR: Your setup > doesn’t work for clients that use Windows XP, but it works > for clients that > use Windows Vista or 7. If you want SSL to work for > everybody, then you need > to use separate IP address for each certificate. Best regards, Piotr S. \< > [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) > > > * * * nginx mailing > list > [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) > [mailman.nginx.org archive](http://nginx.org/mailman/listinfo/nginx)