# SSL on/off on same port and IP

**URL:** <https://www.ruby-forum.com/t/ssl-on-off-on-same-port-and-ip/242424>\
**Category:** NGINX\
**Created:** [June 23, 2015, 4:50pm UTC](https://www.ruby-forum.com/t/ssl-on-off-on-same-port-and-ip/242424 "2015-06-23T16:50:53Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Detlef\_R](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/58f4c7/32.png) [@Detlef\_R](https://www.ruby-forum.com/u/Detlef_R)\
**Post date:** [June 23, 2015, 4:50pm UTC](https://www.ruby-forum.com/t/ssl-on-off-on-same-port-and-ip/242424/1 "2015-06-23T16:50:53Z")

</div>

Hi,

consider the following very simple nginx config:  
http {  
server {  
listen 127.0.0.1:123;  
server\_name abc;  
}  
server {  
listen 127.0.0.1:123 ssl;  
server\_name xyz;  
ssl\_certificate…;  
}  
}

In words:  
I instruct nginx to listen on the same port and IP, one time without  
ssl, one time with ssl. IMHO this is a broken config, however nginx  
accepts it.

What would you say? Should nginx reject such a config? Right now you  
only get an error at request time.

It gets even worse, if the 2nd server is configured with the ssl  
directive instead of “listen ssl”:  
server {  
listen 127.0.0.1:123;  
server\_name xyz;  
ssl on;  
ssl\_certificate…;  
}

In that case you don’t even see an error in the logs anymore and clients  
can’t connect via https anymore.

Cheers, Ingo =;-\>

---

<div class="post-metadata">

**Author:** ![Ingo\_Lafrenz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/439d5e/32.png) [@Ingo\_Lafrenz](https://www.ruby-forum.com/u/Ingo_Lafrenz)\
**Post date:** [July 4, 2015, 8:47am UTC](https://www.ruby-forum.com/t/ssl-on-off-on-same-port-and-ip/242424/2 "2015-07-04T08:47:55Z")

</div>

Hello!

On Tue, Jun 23, 2015 at 04:43:23PM +0200, Ingo Lafrenz wrote:

> ```
> server_name xyz;
> ssl_certificate...;
> }
> 
> ```
> 
> }
> 
> In words:  
> I instruct nginx to listen on the same port and IP, one time without ssl,  
> one time with ssl. IMHO this is a broken config, however nginx accepts it.
> 
> What would you say? Should nginx reject such a config? Right now you only  
> get an error at request time.

The “listen 127.0.0.1:123 ssl;” means that nginx will use SSL on  
the 127.0.0.1:123 listen socket. This works much like with any  
listen socket options: you may specify them once, and omit in other  
server{} blocks.

The only problem with the config in question is that there is no  
ssl certificate defined in the first server. There is a ticket  
about complaining during configuration testing in such a case:

> **[\#178 (listen with ssl but missing ssl\_certificate is not detected by nginx -t)
...](https://trac.nginx.org/nginx/ticket/178)**

But adding such a check isn’t trivial and unlikely to happen soon.

> can’t connect via https anymore.  
> There will be an error in the logs, but at the “info” level -  
> and therefore rarely seen. The socket in question won’t have SSL  
> enabled as there is no “ssl on” in the default (first) server, and  
> therefore nginx will not expect SSL connections and will complain  
> that “client sent invalid method” for all attempts to establish an  
> SSL connection.

Anyway, that’s why “ssl on” is deprecated - it’s very easy to  
configure things wrongly when using it.

–  
Maxim D.

> **[nginx](http://nginx.org/)**