# Wrong server used in SSL request

**URL:** <https://www.ruby-forum.com/t/wrong-server-used-in-ssl-request/235706>\
**Category:** NGINX\
**Created:** [July 10, 2013, 9:41am UTC](https://www.ruby-forum.com/t/wrong-server-used-in-ssl-request/235706 "2013-07-10T09:41:38Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![addis\_a](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/c4cdca/32.png) [@addis\_a](https://www.ruby-forum.com/u/addis_a)\
**Post date:** [July 10, 2013, 9:41am UTC](https://www.ruby-forum.com/t/wrong-server-used-in-ssl-request/235706/1 "2013-07-10T09:41:38Z")

</div>

Hi everyone,

I have a rather strange issue.

I have a server with 3 configured urls:

[example.com](http://example.com) (+ ssl)  
[shop.example.com](http://shop.example.com) (+ ssl)  
[example2.com](http://example2.com) (- ssl)

If I now open [https://example2.com](https://example2.com) the server of  
[https://shop.example.com](https://shop.example.com) is used.

My config looks like this:  
[https://gist.github.com/apfelbox/c13a226633a7df92e3fe](https://gist.github.com/apfelbox/c13a226633a7df92e3fe)

Does anybody have an idea?

Thanks and Regards  
Jannik Zschiesche

---

<div class="post-metadata">

**Author:** ![Jannik\_Zschiesche](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/bbe5ce/32.png) [@Jannik\_Zschiesche](https://www.ruby-forum.com/u/Jannik_Zschiesche)\
**Post date:** [July 10, 2013, 9:43am UTC](https://www.ruby-forum.com/t/wrong-server-used-in-ssl-request/235706/2 "2013-07-10T09:43:58Z")

</div>

Hi,

sorry, wrong link.  
Here is the correct one:

> <https://gist.github.com/apfelbox/94c74ab9c515ee906e6b>
>
> There are more than three files. show original

Regards  
Jannik

–  
Mit freundlichen Grüßen  
Jannik Zschiesche

Am Mittwoch, 10. Juli 2013 um 09:40 schrieb Jannik Zschiesche:

---

<div class="post-metadata">

**Author:** ![Jannik\_Zschiesche](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/bbe5ce/32.png) [@Jannik\_Zschiesche](https://www.ruby-forum.com/u/Jannik_Zschiesche)\
**Post date:** [July 10, 2013, 9:55am UTC](https://www.ruby-forum.com/t/wrong-server-used-in-ssl-request/235706/3 "2013-07-10T09:55:04Z")

</div>

On 10 Jul 2013 08:41, “Jannik Zschiesche” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> If I now open [https://example2.com](https://example2.com) the server of [https://shop.example.comis](https://shop.example.comis)  
> used.
> 
> My config looks like this:  
> [https://gist.github.com/apfelbox/c13a226633a7df92e3fe](https://gist.github.com/apfelbox/c13a226633a7df92e3fe)
> 
> Does anybody have an idea?

This is due to you having only one IP listening for ssl traffic. It’s a  
fundamental limitation of ssl when not used with SNI.

To fix it, you’ll need to either use more IPs and listen explicitly on  
different ones for different virtual hosts, or use SNI, or use a  
wildcard  
(or UCC/SaN) certificate. The first fix is by far the most common for  
people in your situation.

HTH,  
Jonathan

---

<div class="post-metadata">

**Author:** ![Jannik\_Zschiesche](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/bbe5ce/32.png) [@Jannik\_Zschiesche](https://www.ruby-forum.com/u/Jannik_Zschiesche)\
**Post date:** [July 10, 2013, 10:43am UTC](https://www.ruby-forum.com/t/wrong-server-used-in-ssl-request/235706/4 "2013-07-10T10:43:00Z")

</div>

Am Mittwoch, 10. Juli 2013 um 09:54 schrieb Jonathan M.:

> This is due to you having only one IP listening for ssl traffic. It’s a  
> fundamental limitation of ssl when not used with SNI.  
> To fix it, you’ll need to either use more IPs and listen explicitly on different  
> ones for different virtual hosts, or use SNI, or use a wildcard (or UCC/SaN)  
> certificate. The first fix is by far the most common for people in your situation.  
> HTH,  
> Jonathan

Hi,

thank you both.

Actually, I have SNI enabled.

> **[Example Domain](https://example.com)**

and  
[https://shop.example.com](https://shop.example.com)

both work correctly (so SNI works).

The issue is with the nonexistent SSL server for [example2.com](http://example2.com).  
It seems, that if a SSL server for a domain is not configured, another  
server is used (instead of error-ing out). Is this correct?

---

<div class="post-metadata">

**Author:** ![Jannik\_Zschiesche](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/bbe5ce/32.png) [@Jannik\_Zschiesche](https://www.ruby-forum.com/u/Jannik_Zschiesche)\
**Post date:** [July 10, 2013, 10:17am UTC](https://www.ruby-forum.com/t/wrong-server-used-in-ssl-request/235706/5 "2013-07-10T10:17:17Z")

</div>

On Jul 10, 2013, at 11:40 , Jannik Zschiesche wrote:

> If I now open [https://example2.com](https://example2.com) the server of [https://shop.example.com](https://shop.example.com) is  
> used.  
> [Configuring HTTPS servers](http://nginx.org/en/docs/http/configuring_https_servers.html#name_based_https_servers)

---

<div class="post-metadata">

**Author:** ![Jannik\_Zschiesche](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/bbe5ce/32.png) [@Jannik\_Zschiesche](https://www.ruby-forum.com/u/Jannik_Zschiesche)\
**Post date:** [July 10, 2013, 1:20pm UTC](https://www.ruby-forum.com/t/wrong-server-used-in-ssl-request/235706/6 "2013-07-10T13:20:12Z")

</div>

> It seems, that if a SSL server for a domain is not configured, another  
> server is used (instead of error-ing out). Is this correct?

Yes, the default/first server.  
The “error-ing out” (with option to proceed anyway) usually happens on  
the  
client side/browser which checks that the host name doesn’t match the  
server  
SSL certificate.

rr