# Weird SSL Issue

**URL:** <https://www.ruby-forum.com/t/weird-ssl-issue/225482>\
**Category:** NGINX\
**Created:** [January 10, 2013, 12:21pm UTC](https://www.ruby-forum.com/t/weird-ssl-issue/225482 "2013-01-10T12:21:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![aris](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/258eb7/32.png) [@aris](https://www.ruby-forum.com/u/aris)\
**Post date:** [January 10, 2013, 12:21pm UTC](https://www.ruby-forum.com/t/weird-ssl-issue/225482/1 "2013-01-10T12:21:49Z")

</div>

I use nginx to host multiple websites, and one of them has a valid SSL  
certificate. I’ve noticed recently (from early November 2012 according  
to  
Google Webmaster Tools), that if I make an SSL connection to one of the  
sites which does not have a valid SSL cert, I get the content of the  
site  
that does.

That is, is [example.com](http://example.com) has the SSL cert, and I host [example2.com](http://example2.com)  
without,  
if I go to [https://example2.com](https://example2.com) I will get the homepage for [example.com](http://example.com).

This is despite the fact that the configuration file for  
example2.comdoesn’t have anything concerning SSL in it (not even  
listening on port  
443), and the configuration file for [example.com](http://example.com) doesn’t have anything  
concerning [example2.com](http://example2.com).

If configuration files are needed, I can provide them. However this was  
definitely not an issue before November. I suspect it started happening  
after I upgraded to the latest stable release of nginx.

Any help is appreciated.

---

<div class="post-metadata">

**Author:** ![captaffy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/f04885/32.png) [@captaffy](https://www.ruby-forum.com/u/captaffy)\
**Post date:** [January 10, 2013, 12:38pm UTC](https://www.ruby-forum.com/t/weird-ssl-issue/225482/2 "2013-01-10T12:38:45Z")

</div>

On Thu, Jan 10, 2013 at 6:20 PM, Adrian H. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> doesn’t have anything concerning SSL in it (not even listening on port 443),  
> and the configuration file for [example.com](http://example.com) doesn’t have anything concerning  
> [example2.com](http://example2.com).

Because there’s something listening on port 443. When there’s no  
matching server\_name but there’s something listening on that port,  
that block will handle the request.

If you have dedicated ip for ssl host, set the ip. Otherwise, just  
create a default fallback server block for ssl and handle redirect  
from there.

---

<div class="post-metadata">

**Author:** ![captaffy](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/f04885/32.png) [@captaffy](https://www.ruby-forum.com/u/captaffy)\
**Post date:** [January 10, 2013, 1:12pm UTC](https://www.ruby-forum.com/t/weird-ssl-issue/225482/3 "2013-01-10T13:12:38Z")

</div>

Ok, so how do I prevent that? I only want the content of [example.com](http://example.com) to  
be  
sent when [example.com](http://example.com) is given as the host in the HTTP request. Can you  
give examples?