# SSL questions **URL:** \ **Category:** NGINX\ **Created:** [November 28, 2008, 10:48pm UTC](https://www.ruby-forum.com/t/ssl-questions/154411 "2008-11-28T22:48:26Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![archfiend997](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/50afbb/32.png) [@archfiend997](https://www.ruby-forum.com/u/archfiend997)\ **Post date:** [November 28, 2008, 10:48pm UTC](https://www.ruby-forum.com/t/ssl-questions/154411/1 "2008-11-28T22:48:26Z")
Hello, 1. How does the following change in 0.6.34 impact existing configurations: What rewrites would be affected? For example: rewrite (.\*) https://$host$1 permanent; 1. How does nginx determine the default HTTPS server? Setting the default HTTP server is well defined, but it is not clear to me what server is used if the default HTTP server does not support SSL. Thanks, ---
**Author:** ![archfiend997](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/50afbb/32.png) [@archfiend997](https://www.ruby-forum.com/u/archfiend997)\ **Post date:** [November 28, 2008, 11:48pm UTC](https://www.ruby-forum.com/t/ssl-questions/154411/2 "2008-11-28T23:48:11Z")
Hello! On Fri, Nov 28, 2008 at 01:41:40PM -0800, Adam Z. wrote: > Hello, > > 1. How does the following change in 0.6.34 impact existing configurations: > > What rewrites would be affected? For example: rewrite (.\*) > https://$host$1 permanent; This only affects rewrites without explicit redirect or permanent flags set, e.g ``` rewrite ^ https://example.com/; ``` won’t do anything sensible before 0.6.34 and should be written explicitly as ``` rewrite ^ https://example.com/ redirect; ``` > 1. How does nginx determine the default HTTPS server? Setting the > default HTTP server is well defined, but it is not clear to me what > server is used if the default HTTP server does not support SSL. Each server has list of listening sockets associated with it (see [http://wiki.codemongers.com/NginxHttpCoreModule#listen](http://wiki.codemongers.com/NginxHttpCoreModule#listen)). Only servers listening on particular ip:port are used when selecting appropriate server to serve request. Since on given ip:port you can either use ssl or not (but not both - by design of https protocol) - servers without ssl support can’t be selected to serve https requests. Maxim D. ---
**Author:** ![archfiend997](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/50afbb/32.png) [@archfiend997](https://www.ruby-forum.com/u/archfiend997)\ **Post date:** [November 29, 2008, 12:59am UTC](https://www.ruby-forum.com/t/ssl-questions/154411/3 "2008-11-29T00:59:02Z")
Greetings, On Fri, Nov 28, 2008 at 2:41 PM, Maxim D. wrote: \> https requests. \> Perhaps I did not phrase this correctly. I have an HTTP default server such as the following: server { listen 80 default; } Any HTTP request that does not match a server\_name in any other configuration block will fall back to this setting. Now, I also have multiple HTTPS servers all using the same wildcard certificate and port: ssl\_certificate cert/wildcard.cert; ssl\_certificate\_key cert/wildcard.key; server { listen 443; ssl on; server\_name [foo.mydomain.com](http://foo.mydomain.com); } server { listen 443; ssl on; server\_name [bar.mydomain.com](http://bar.mydomain.com); } Suppose a request to [https://baz.mydomain.com](https://baz.mydomain.com) is received by nginx. ‘[baz.mydomain.com](http://baz.mydomain.com)’ will not match either of the server\_name settings for SSL, but will still be forwarded to one of the above servers. It is not clear to me how nginx picks which HTTPS server to forward the request to, or what the correct response should be given that the default server defined in the configuration does not support HTTPS. Best, ---
**Author:** ![archfiend997](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/50afbb/32.png) [@archfiend997](https://www.ruby-forum.com/u/archfiend997)\ **Post date:** [November 29, 2008, 2:29am UTC](https://www.ruby-forum.com/t/ssl-questions/154411/4 "2008-11-29T02:29:03Z")
Hello! On Fri, Nov 28, 2008 at 03:50:30PM -0800, Adam Z. wrote: > > servers listening on particular ip:port are used when selecting > > } > > listen 443; > > Suppose a request to [https://baz.mydomain.com](https://baz.mydomain.com) is received by nginx. > > ‘[baz.mydomain.com](http://baz.mydomain.com)’ will not match either of the server\_name settings > > for SSL, but will still be forwarded to one of the above servers. It > > is not clear to me how nginx picks which HTTPS server to forward the > > request to, or what the correct response should be given that the > > default server defined in the configuration does not support HTTPS. The ‘default’ isn’t property of server, it’s property of listening socket. In the above configuration there is no explicit default for listen socket \*:443, so default is first one (in this case - one in [foo.mydomain.com](http://foo.mydomain.com) server). Just to be clear, here is short description of procedure nginx uses to determine correct server to process request (not exact, but logic to keep in mind): 1. For each request we know local ip:port pair. For this ip:port we select all servers that has listen on this ip:port. 2. If resulting list is empty - we select all servers that has listen on \*:port. 3. If we have only 1 server in the resulting list - we are done (real non-virtual host case). 4. If more than one server found for the ip:port pair - it’s virtual host case. Here server\_name matching against ‘Host’ header comes, with all tricky wildcards and so on. I’ll omit details for clarity. 5. If server\_name matching found something - we are done. 6. If nothing found, we use default server _for this listening socket_ - either explicitly specified using ‘listen … default’ or implicit one (i.e. configured first). Maxim D.