nginx two sites configuration conflict

Question

I have nginx configured for one of my domains. It works as a frontend to Wildfly application server. One day I decided to configure beta tests environment on the same machine. So I added another subdomain to configuration. After restart nginx stopped to serve the first application. My configuration files are:

main subdomain:

server {
    listen 80;
    server_name sub.example.com;
    return 301 https://$host$request_uri;
}

server {

    listen 443;
    server_name sub.example.com;

    ssl_certificate           /etc/nginx/ssl/bundle.crt;
    ssl_certificate_key       /etc/nginx/ssl/sub.example.com.key;

    ssl on;
    ssl_session_cache  builtin:1000  shared:SSL:10m;
    ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
    ssl_prefer_server_ciphers on;

    access_log            /var/log/nginx/sub.example.com.access.log;

    location / {

      proxy_set_header        Host $host;
      proxy_set_header        X-Real-IP $remote_addr;
      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header        X-Forwarded-Proto $scheme;

      proxy_pass          http://localhost:8080;
      proxy_read_timeout  90;
    }
}

test subdomain:

server {
    listen 443;
    server_name sub-test.example.com;
    return 301 http://$host$request_uri;
}

server {

    listen 80;
    server_name sub-test.example.com;


    access_log            /var/log/nginx/sub-test.example.com.access.log;

    location / {

      proxy_set_header        Host $host;
      proxy_set_header        X-Real-IP $remote_addr;
      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header        X-Forwarded-Proto $scheme;

      proxy_pass          http://localhost:8080;
      proxy_read_timeout  90;

    }
}

I need to add that every of above configurations work as expected when alone. But together they don't like each other. Requesting for the first of them returns NOT FOUND HTTP status.

Of course, problem may be located on my Wildfly server. It's configured to handle virtual hosts and I'm not really sure it's OK. But when both applications are run and only one of them is proxied by nginx, it works fine.

Thanks for help.

Answer 1

Patryk, unfortunately you can't set more than one name based HTTPS server. The explanations is long, but you can check here for some indeep information and examples (apache based, have no idea about nginx)

Answer 2

You can use more than one https site.

The technology is called SNI, or server name indication.Reference

By moving the ssl part out of the server configs you also reduce the overhaed for configuring the certificates. I use the following structure on my reverse proxies:

sites.d/ | -ssl.conf | -vhost1.conf | -vhost2.conf

ssl.conf then contains:

ssl_certificate /etc/ssl/certs/ssl.crt; ssl_certificate_key /etc/ssl/certs/server.key;

Another option would be the use of separate certificates with different common names.