The problem of configuring multiple server HTTPS under Nginx single IP

Our load-balancing architecture is this:

Request, network---LVS cluster, Nginx cluster, APP

LVS use Fullnat mode, each nginx machine has only one IP (intranet IP), LVS is also the traffic to this IP. If Nginx wants to use HTTPS for multiple domain names, such as two domain names wandoujia.com and wandoulabs.com, there may be a problem.

Look at the configuration below (two servers are written in different files, loaded with include *):

server {

Listen 80;

Listen 443 SSL;

server_name test.wandoujia.com;

Ssl_certificate WANDOUJIA.CRT;

Ssl_certificate_key Wandoujia.key;

Ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;

Ssl_ciphers high:!anull:! MD5;

...

}

server {

Listen 80;

Listen 443 SSL;

server_name test.wandoulabs.com;

Ssl_certificate WANDOULABS.CRT;

Ssl_certificate_key Wandoulabs.key;

Ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;

Ssl_ciphers high:!anull:! MD5;

...

}

So you visit https://test.wandoujia.com or https://test.wandoulabs.com, you may report a certificate problem, which is why.

In fact, SSL is running over TCP (SSL/TLS protocol), SSL is established via four handshake and the server (here is Nginx,lvs pure forwarding, negligible) IP + PORT (443) to establish an SSL connection and the browser will not send an HTTP request until the connection is established. Therefore, after the Nginx received the HTTP request to know the host, just know which server to go to processing, so when the SSL connection is established, Nginx is not aware of which server SSL configuration, in this case, Nginx will use it to load the first SSL configuration (verification required). Of course, if you add Default_server,nginx to the back of listen 443, you'll use this SSL configuration, which is:

Listen 443 default_server SSL;

So for the single-domain HTTPS, I prefer to write the SSL configuration in the HTTP configuration, the server only need to add listen 443 SSL;, similar to:

HTTP {

...

Ssl_certificate WANDOUJIA.CRT;

Ssl_certificate_key Wandoujia.key;

#ssl_certificate WANDOULABS.CRT;

#ssl_certificate_key Wandoulabs.key;

Ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;

Ssl_ciphers high:!anull:! MD5;

...

}

server {

Listen 80;

Listen 443 SSL;

server_name test.wandoujia.com;

...

}

#server {

# Listen 80;

# Listen 443 SSL;

# server_name test.wandoulabs.com;

#    ...

#}

So how to implement multi-domain HTTPS, there is a way, called TLS server name Indication extension (SNI, RFC 6066), which allows the browser to send the Server name of the request when the SSL handshake, that is Hos T, so Nginx can find the corresponding server SSL configuration.

However, the browser supports SNI only, and the browser that supports SNI has:

Opera 8.0;

MSIE 7.0 (but only on Windows Vista or higher);

Firefox 2.0 and other browsers using Mozilla Platform rv:1.8.1;

Safari 3.2.1 (Windows version supports SNI on Vista or higher);

and Chrome (Windows version supports SNI on Vista or higher, too).

Similarly, the server-side OpenSSL to support SNI, the compile time with –enable-tlsext, but from the beginning of the 0.9.8j version of the compiler will be added by default. OpenSSL supports Sni,nginx to work, confirming that it is OK:

$./nginx-v

...

TLS SNI Support Enabled

...

So, if you want to implement multi-domain HTTPS, confirm that your nginx supports TLS SNI support, and then configure SSL separately on the server, but be aware that some browsers are problematic, and because Nginx loads the server in a different order ( Especially if each server is in a different file in the same directory and then included in the nginx.conf master configuration file with include *, there may be strange problems that I have encountered.

The problem of configuring multiple server HTTPS under Nginx single IP