Home / server / Questions / 807424
In Process
Deaton
Asked: 2016-10-07 01:05:03 +0800 CST

Nginx reverse proxy. 1 SSL cert. Multiple domain names. Do I need a SSL SAN Cert?

  • 772



I have a Nginx reverse proxy setup and working fine with SSL certs, both standard and multi SAN. If I set up a virtual server, such as mysite.com with a standard SSL everything is fine. If I add to the same virtual server the domain name mysite.co.uk in a browser I get the error message that the certificate for the website it invalid.

I understand why I get this error message, what I want to know is can I use Nginx to forward mysite.co.uk to mysite.com to avoid the error message in the browser?
I've tried using rewrites on Nginx, but I don't think that's the way to do it.

I can't do this at the DNS level, as my clients DNS doesn't allow this. It's not just for one domain, there are quite a few and I need to keep the cost down and not purchase a SAN SSL.

Thanks in advance for any help.

ssl nginx reverse-proxy

1 Answers

  1. Each domain needs an entry in the certificate, because the SSL handshake part is done before any redirect rules are processed.

    Regarding the costs, one idea would be to create an SNI enabled virtual host that does nothing else but redirect to the main domain, and use free certificates for it. Letsencrypt lets you add multiple domain names in one certificate (basically a free SAN cert). Just make sure they all have valid DNS records that point to that SNI virtual host's IP.

    • 0