# Unable to use multiple IPs with SSL (0.7.64)

**URL:** <https://www.ruby-forum.com/t/unable-to-use-multiple-ips-with-ssl-0-7-64/197797>\
**Category:** NGINX\
**Created:** [October 20, 2010, 12:02pm UTC](https://www.ruby-forum.com/t/unable-to-use-multiple-ips-with-ssl-0-7-64/197797 "2010-10-20T12:02:00Z")\
**Posts on this page:** 18\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dobai-Pataky\_BSSSSl](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/77aa72/32.png) [@Dobai-Pataky\_BSSSSl](https://www.ruby-forum.com/u/Dobai-Pataky_BSSSSl)\
**Post date:** [October 20, 2010, 12:02pm UTC](https://www.ruby-forum.com/t/unable-to-use-multiple-ips-with-ssl-0-7-64/197797/1 "2010-10-20T12:02:00Z")

</div>

I have an nginx (v0.7.64) configuration that requires a number of  
virtual hosts each with their own SSL.

I have assigned different IP addresses to each vhost. All IP addresses  
are available on port 443 (i.e. they are not blocked by firewall). All  
certificates are from Thawte.

When I test nginx configuration (nginx -t), I get the following error:

[quote]the configuration file /usr/local/nginx/conf/nginx.conf syntax is  
ok  
[emerg]: bind() to IP1:443 failed (99: Cannot assign requested address)  
configuration file /usr/local/nginx/conf/nginx.conf test failed[/quote]

(where IP1 is one of our IP addresses)

This is the abridged configuration:

```auto
user apache;
worker_processes 4;
worker_rlimit_nofile 4112;

events {
    worker_connections 4112;
}

http {
    include mime.types;
    default_type application/octet-stream;
    sendfile on;
    keepalive_timeout 65;
    send_timeout 300;

    upstream webapp {
  server UPSTREAM_IP1;
        server UPSTREAM_IP2;
    }

    server {
  listen 843;
  server_name localhost;

  location / {
    rewrite ^(.*)$ /crossdomain.xml;
  }

  error_page 400 /crossdomain.xml;

  location /crossdomain.xml {
    root /var/www/html;
  }
    }

    server {
        listen 80;
        server_name localhost;

        location /media {
            access_log off;
            root /var/www/html;
            index index.html index.htm;
            expires 24h;
        }

  location / {
            access_log off;
            proxy_connect_timeout 15;
      proxy_next_upstream error;
      proxy_pass http://webapp;
      proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For
$proxy_add_x_forwarded_for;
            proxy_redirect off;

  }

        error_page 500 502 503 504 /50x.html;
        location = /50x.html {
            root html;
        }

        location ~ /\.ht {
            deny all;
        }
    }

server {
        listen IP1:443;
        server_name *.firstdomain.com;

        ssl on;
        ssl_certificate /var/ssl/firstdomain.crt;
        ssl_certificate_key /var/ssl/firstdomain.key;

        location /media {
            root /var/www/html;
            index index.html index.htm;
        }

  location / {
            access_log off;
            proxy_connect_timeout 15;
      proxy_next_upstream error;
      proxy_pass http://webapp;
      proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-Protocol https;
            proxy_set_header X-Forwarded-For
$proxy_add_x_forwarded_for;
            proxy_redirect off;
  }

}
    server {
        listen IP2:443;
        server_name *.seconddomain.com;

        ssl on;
        ssl_certificate /var/ssl/seconddomain.crt;
        ssl_certificate_key /var/ssl/seconddomain.key;

        location /media {
            root /var/www/html;
            index index.html index.htm;
        }

  location / {
            access_log off;
            proxy_connect_timeout 15;
      proxy_next_upstream error;
      proxy_pass http://webapp;
      proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-Protocol https;
            proxy_set_header X-Forwarded-For
$proxy_add_x_forwarded_for;
            proxy_redirect off;
  }

}

server {
        listen IP3:443;
        server_name *.thirddomain.com;

        ssl on;
        ssl_certificate /var/ssl/thirddomain.crt;
        ssl_certificate_key /var/ssl/thirddomain.key;

        location /media {
            root /var/www/html;
            index index.html index.htm;
        }

  location / {
            access_log off;
            proxy_connect_timeout 15;
      proxy_next_upstream error;
      proxy_pass http://webapp;
      proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-Protocol https;
            proxy_set_header X-Forwarded-For
$proxy_add_x_forwarded_for;
            proxy_redirect off;
  }

}
```

Posted at Nginx Forum:

> **[Unable to use multiple IPs with SSL (0.7.64)](https://forum.nginx.org/read.php?2,142634,142634#msg-142634)**
>
> I have an nginx (v0.7.64) configuration that requires a number of virtual hosts each with their own SSL. I have assigned different IP addresses to each vhost. All IP addresses are available on port 443 (i.e. they are not blocked by firewall). All...

---

<div class="post-metadata">

**Author:** ![danjac](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/c5a1d2/32.png) [@danjac](https://www.ruby-forum.com/u/danjac)\
**Post date:** [October 20, 2010, 12:14pm UTC](https://www.ruby-forum.com/t/unable-to-use-multiple-ips-with-ssl-0-7-64/197797/2 "2010-10-20T12:14:02Z")

</div>

Hi,

You can’t use more than one SSL server in the same ip/port pair unless  
you use SNI (which is still non-standard). I don’t think the bid error  
is SSL related.

And i could be wrong 🙂

Bye,  
Nuno

---

<div class="post-metadata">

**Author:** ![danjac](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/c5a1d2/32.png) [@danjac](https://www.ruby-forum.com/u/danjac)\
**Post date:** [October 20, 2010, 12:15pm UTC](https://www.ruby-forum.com/t/unable-to-use-multiple-ips-with-ssl-0-7-64/197797/3 "2010-10-20T12:15:18Z")

</div>

On Wed, Oct 20, 2010 at 06:00:38AM -0400, danjac wrote:

> ok  
> [emerg]: bind() to IP1:443 failed (99: Cannot assign requested address)  
> configuration file /usr/local/nginx/conf/nginx.conf test failed[/quote]
> 
> (where IP1 is one of our IP addresses)

Are you sure that IP1 is configured on this host ?  
This error means that there is no such address.

It’s better to rewrite this:

> location /crossdomain.xml {  
> root /var/www/html;  
> }  
> }

as

```
 server {

```

listen 843;  
server\_name localhost;

location = / {  
alias /var/www/html/crossdomain.xml;  
}

error\_page 400 /crossdomain.xml;

location = /crossdomain.xml {  
root /var/www/html;  
}  
}

–  
Igor S.

> **[Igor Sysoev](http://sysoev.ru/en/)**

---

<div class="post-metadata">

**Author:** ![danjac](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/c5a1d2/32.png) [@danjac](https://www.ruby-forum.com/u/danjac)\
**Post date:** [October 20, 2010, 12:44pm UTC](https://www.ruby-forum.com/t/unable-to-use-multiple-ips-with-ssl-0-7-64/197797/4 "2010-10-20T12:44:56Z")

</div>

On Wed, Oct 20, 2010 at 06:22:59AM -0400, danjac wrote:

> The IP is configured for this address, yes.

Then something wrong in this configuration.  
This is not nginx issue.  
You can workaround it by binding only to \*:443 and letting nginx to  
learn  
address at run-time:

```
server {
    listen *:443;
    listen IP1:443;
}

server {
    listen IP2:443;
}

server {
    listen IP3:443;
}

```

–  
Igor S.

> **[Igor Sysoev](http://sysoev.ru/en/)**

---

<div class="post-metadata">

**Author:** ![danjac](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/c5a1d2/32.png) [@danjac](https://www.ruby-forum.com/u/danjac)\
**Post date:** [October 20, 2010, 12:23pm UTC](https://www.ruby-forum.com/t/unable-to-use-multiple-ips-with-ssl-0-7-64/197797/5 "2010-10-20T12:23:33Z")

</div>

The IP is configured for this address, yes.

Posted at Nginx Forum:

> **[Re: Unable to use multiple IPs with SSL (0.7.64)](https://forum.nginx.org/read.php?2,142634,142639#msg-142639)**
>
> I have an nginx (v0.7.64) configuration that requires a number of virtual hosts each with their own SSL. I have assigned different IP addresses to each vhost. All IP addresses are available on port 443 (i.e. they are not blocked by firewall). All...

---

<div class="post-metadata">

**Author:** ![danjac](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/c5a1d2/32.png) [@danjac](https://www.ruby-forum.com/u/danjac)\
**Post date:** [October 20, 2010, 1:15pm UTC](https://www.ruby-forum.com/t/unable-to-use-multiple-ips-with-ssl-0-7-64/197797/6 "2010-10-20T13:15:55Z")

</div>

This solution works (i.e. I can restart nginx) but it doesn’t recognize  
the correct domain - certificate for [firstdomain.com](http://firstdomain.com) is correct, but  
when I go to the [seconddomain.com](http://seconddomain.com) I get the SSL error “this site was  
configured for [firstdomain.com](http://firstdomain.com)” in my browser.

## Igor S. Wrote:

> ```
> listen IP3:443;
> 
> ```
> 
> [mailman.nginx.org archive](http://nginx.org/mailman/listinfo/nginx)  
> Posted at Nginx Forum:  
> [http://forum.nginx.org/read.php?2,142634,142659#msg-142659](http://forum.nginx.org/read.php?2,142634,142659#msg-142659)

---

<div class="post-metadata">

**Author:** ![danjac](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/c5a1d2/32.png) [@danjac](https://www.ruby-forum.com/u/danjac)\
**Post date:** [October 20, 2010, 12:46pm UTC](https://www.ruby-forum.com/t/unable-to-use-multiple-ips-with-ssl-0-7-64/197797/7 "2010-10-20T12:46:11Z")

</div>

As you can see, they are all using different IPs.

Posted at Nginx Forum:

> **[Re: Unable to use multiple IPs with SSL (0.7.64)](https://forum.nginx.org/read.php?2,142634,142650#msg-142650)**
>
> I have an nginx (v0.7.64) configuration that requires a number of virtual hosts each with their own SSL. I have assigned different IP addresses to each vhost. All IP addresses are available on port 443 (i.e. they are not blocked by firewall). All...

---

<div class="post-metadata">

**Author:** ![danjac](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/c5a1d2/32.png) [@danjac](https://www.ruby-forum.com/u/danjac)\
**Post date:** [October 20, 2010, 1:50pm UTC](https://www.ruby-forum.com/t/unable-to-use-multiple-ips-with-ssl-0-7-64/197797/8 "2010-10-20T13:50:45Z")

</div>

On Wed, Oct 20, 2010 at 07:15:05AM -0400, danjac wrote:

> This solution works (i.e. I can restart nginx) but it doesn’t recognize  
> the correct domain - certificate for [firstdomain.com](http://firstdomain.com) is correct, but  
> when I go to the [seconddomain.com](http://seconddomain.com) I get the SSL error “this site was  
> configured for [firstdomain.com](http://firstdomain.com)” in my browser.

You see certificate for [firstdomain.com](http://firstdomain.com) for all addresse - IP2 and IP3 ?  
It seems that these IP-addresses are not really configured on the host.  
And the previous error “Cannot assign requested address” is related to  
this.

> > letting nginx to learn
> > 
> > ```
> > server {
> > listen IP3:443;
> > }
> > 
> > ```

–  
Igor S.

> **[Igor Sysoev](http://sysoev.ru/en/)**

---

<div class="post-metadata">

**Author:** ![danjac](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/c5a1d2/32.png) [@danjac](https://www.ruby-forum.com/u/danjac)\
**Post date:** [October 20, 2010, 2:33pm UTC](https://www.ruby-forum.com/t/unable-to-use-multiple-ips-with-ssl-0-7-64/197797/9 "2010-10-20T14:33:38Z")

</div>

> You see certificate for [firstdomain.com](http://firstdomain.com) for all  
> addresse - IP2 and IP3 ?

I’m not sure I quite understand. Each IP address is set for each domain  
and has its own certificate.

> > > ```
> > > listen *:443;
> > > 
> > > ```
> 
> –  
> Igor S.  
> [Igor Sysoev](http://sysoev.ru/en/)
> 
> * * *
> 
> nginx mailing list  
> [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
> [mailman.nginx.org archive](http://nginx.org/mailman/listinfo/nginx)

Posted at Nginx Forum:  
[http://forum.nginx.org/read.php?2,142634,142687#msg-142687](http://forum.nginx.org/read.php?2,142634,142687#msg-142687)

---

<div class="post-metadata">

**Author:** ![danjac](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/c5a1d2/32.png) [@danjac](https://www.ruby-forum.com/u/danjac)\
**Post date:** [October 20, 2010, 2:47pm UTC](https://www.ruby-forum.com/t/unable-to-use-multiple-ips-with-ssl-0-7-64/197797/10 "2010-10-20T14:47:28Z")

</div>

> > You see certificate for [firstdomain.com](http://firstdomain.com) for all  
> > addresse - IP2 and IP3 ?
> 
> I’m not sure I quite understand. Each IP address is set for each  
> domain  
> and has its own certificate.

> Yes, but currently do you see only certificate of [firstdomain.com](http://firstdomain.com) for  
> all requests ?

Yes. I’ll check with our hosting provider to ensure these IPs are set  
correctly.

Posted at Nginx Forum:  
[http://forum.nginx.org/read.php?2,142634,142690#msg-142690](http://forum.nginx.org/read.php?2,142634,142690#msg-142690)

---

<div class="post-metadata">

**Author:** ![danjac](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/c5a1d2/32.png) [@danjac](https://www.ruby-forum.com/u/danjac)\
**Post date:** [October 20, 2010, 2:35pm UTC](https://www.ruby-forum.com/t/unable-to-use-multiple-ips-with-ssl-0-7-64/197797/11 "2010-10-20T14:35:31Z")

</div>

On Wed, Oct 20, 2010 at 08:32:30AM -0400, danjac wrote:

> > You see certificate for [firstdomain.com](http://firstdomain.com) for all  
> > addresse - IP2 and IP3 ?
> 
> I’m not sure I quite understand. Each IP address is set for each domain  
> and has its own certificate.

Yes, but currently do you see only certificate of [firstdomain.com](http://firstdomain.com) for  
all requests ?

> > > > ```
> > > > listen *:443;
> > > > 
> > > > ```
> 
> Posted at Nginx Forum:  
> [http://forum.nginx.org/read.php?2,142634,142687#msg-142687](http://forum.nginx.org/read.php?2,142634,142687#msg-142687)
> 
> * * *
> 
> nginx mailing list  
> [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
> [mailman.nginx.org archive](http://nginx.org/mailman/listinfo/nginx)

–  
Igor S.

> **[Igor Sysoev](http://sysoev.ru/en/)**

---

<div class="post-metadata">

**Author:** ![danjac](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/c5a1d2/32.png) [@danjac](https://www.ruby-forum.com/u/danjac)\
**Post date:** [October 20, 2010, 3:11pm UTC](https://www.ruby-forum.com/t/unable-to-use-multiple-ips-with-ssl-0-7-64/197797/12 "2010-10-20T15:11:25Z")

</div>

I’ve double-checked the IP addresses, they are all resolving correctly  
to this host.

Posted at Nginx Forum:

> **[Re: Unable to use multiple IPs with SSL (0.7.64)](https://forum.nginx.org/read.php?2,142634,142695#msg-142695)**
>
> I have an nginx (v0.7.64) configuration that requires a number of virtual hosts each with their own SSL. I have assigned different IP addresses to each vhost. All IP addresses are available on port 443 (i.e. they are not blocked by firewall). All...

---

<div class="post-metadata">

**Author:** ![danjac](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/c5a1d2/32.png) [@danjac](https://www.ruby-forum.com/u/danjac)\
**Post date:** [October 20, 2010, 3:29pm UTC](https://www.ruby-forum.com/t/unable-to-use-multiple-ips-with-ssl-0-7-64/197797/13 "2010-10-20T15:29:43Z")

</div>

Yes, telnet works too.

Posted at Nginx Forum:

> **[Re: Unable to use multiple IPs with SSL (0.7.64)](https://forum.nginx.org/read.php?2,142634,142702#msg-142702)**
>
> I have an nginx (v0.7.64) configuration that requires a number of virtual hosts each with their own SSL. I have assigned different IP addresses to each vhost. All IP addresses are available on port 443 (i.e. they are not blocked by firewall). All...

---

<div class="post-metadata">

**Author:** ![danjac](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/c5a1d2/32.png) [@danjac](https://www.ruby-forum.com/u/danjac)\
**Post date:** [October 20, 2010, 3:19pm UTC](https://www.ruby-forum.com/t/unable-to-use-multiple-ips-with-ssl-0-7-64/197797/14 "2010-10-20T15:19:38Z")

</div>

On Wed, Oct 20, 2010 at 09:09:48AM -0400, danjac wrote:

> I’ve double-checked the IP addresses, they are all resolving correctly  
> to this host.

They must be configured on this host, not only be resolved.  
Are you able to ping them ?

–  
Igor S.

> **[Igor Sysoev](http://sysoev.ru/en/)**

---

<div class="post-metadata">

**Author:** ![danjac](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/c5a1d2/32.png) [@danjac](https://www.ruby-forum.com/u/danjac)\
**Post date:** [October 21, 2010, 2:38pm UTC](https://www.ruby-forum.com/t/unable-to-use-multiple-ips-with-ssl-0-7-64/197797/15 "2010-10-21T14:38:42Z")

</div>

On Thu, Oct 21, 2010 at 07:53:29AM -0400, danjac wrote:

> OK, the error I now get is this (nginx error log file):

So, has IP issue been resolved ?

> If I just set the default to “\*:443” I get the browser error “Error  
> code: ssl\_error\_rx\_record\_too\_long” (in various browsers).

Have you read this

> **[Configuring HTTPS servers](http://nginx.org/en/docs/http/configuring_https_servers.html)**

?

–  
Igor S.

> **[Igor Sysoev](http://sysoev.ru/en/)**

---

<div class="post-metadata">

**Author:** ![danjac](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/c5a1d2/32.png) [@danjac](https://www.ruby-forum.com/u/danjac)\
**Post date:** [October 21, 2010, 2:55pm UTC](https://www.ruby-forum.com/t/unable-to-use-multiple-ips-with-ssl-0-7-64/197797/16 "2010-10-21T14:55:45Z")

</div>

The IP addresses are fine, they are configured correctly on the host as  
far as I (and our hosting company) can verify.

> Have you read this  
> [Configuring HTTPS servers](http://nginx.org/en/docs/http/configuring_https_servers.html)  
> ?

I take it you mean this section:

> [@](#):
>
> The oldest and most robust method to resolve the issue is to assign a  
> separate IP address for every HTTPS server:
> 
> server {  
> listen 192.168.1.1:443;  
> server\_name [www.nginx.com](http://www.nginx.com);  
> ssl on;  
> ssl\_certificate www.nginx.com.crt;  
> …  
> }
> 
> server {  
> listen 192.168.1.2:443;  
> server\_name [www.nginx.org](http://www.nginx.org);  
> ssl on;  
> ssl\_certificate www.nginx.org.crt;  
> …  
> }

Which is what I’ve been trying to do. Unless you mean some other  
specific part of that page ?

Posted at Nginx Forum:  
[http://forum.nginx.org/read.php?2,142634,143119#msg-143119](http://forum.nginx.org/read.php?2,142634,143119#msg-143119)

---

<div class="post-metadata">

**Author:** ![danjac](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/c5a1d2/32.png) [@danjac](https://www.ruby-forum.com/u/danjac)\
**Post date:** [October 22, 2010, 1:22am UTC](https://www.ruby-forum.com/t/unable-to-use-multiple-ips-with-ssl-0-7-64/197797/17 "2010-10-22T01:22:20Z")

</div>

Working now, and you were correct, the issue was with IP addresses.

The IP addresses used needed to be the internal IP addresses, not the  
public external IPs. So for example one of our addresses was  
99.999.9.102:443, it should have been instead 192.168.100.102:443.  
Stupid mistake on my part.

Posted at Nginx Forum:

> **[Re: Unable to use multiple IPs with SSL (0.7.64)](https://forum.nginx.org/read.php?2,142634,143286#msg-143286)**
>
> I have an nginx (v0.7.64) configuration that requires a number of virtual hosts each with their own SSL. I have assigned different IP addresses to each vhost. All IP addresses are available on port 443 (i.e. they are not blocked by firewall). All...

---

<div class="post-metadata">

**Author:** ![danjac](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/c5a1d2/32.png) [@danjac](https://www.ruby-forum.com/u/danjac)\
**Post date:** [October 21, 2010, 1:54pm UTC](https://www.ruby-forum.com/t/unable-to-use-multiple-ips-with-ssl-0-7-64/197797/18 "2010-10-21T13:54:34Z")

</div>

OK, the error I now get is this (nginx error log file):

> [@](#):
>
> [error] 27054#0: \*233 no “ssl\_certificate” is defined in server  
> listening on SSL port while SSL handshaking, client: 77.97.200.235,  
> server: 0.0.0.0:443

In the Firefox this appears as “The connection to the server was reset  
while the page was loading.”.

This is when I set the default for port 443 to “\*:443 default ssl”.

If I just set the default to “\*:443” I get the browser error “Error  
code: ssl\_error\_rx\_record\_too\_long” (in various browsers).

Posted at Nginx Forum:  
[http://forum.nginx.org/read.php?2,142634,143100#msg-143100](http://forum.nginx.org/read.php?2,142634,143100#msg-143100)