Bad certificate use

Projects NGINX
, , ,
1

Please use this template for troubleshooting questions.

My issue: The publication is not using the correct SSL certificate.

How I encountered the problem: When creating a new configuration file

Solutions I’ve tried: deactivation of other publications

Version of NGINX or NGINX adjacent software (e.g. NGINX Gateway Fabric): nginx version: nginx/1.26.3

Deployment environment: Debian 13

Minimal NGINX config to reproduce your issue (preferably running on NGINX Playground | tech-playground.com for ease of debugging, and if not as a code block): (Tip → Run nginx -T to print your entire NGINX config to your terminal.)

NGINX access/error log: (Tip → You can usually find the logs in the /var/log/nginx directory.)

2

Hi @OliJan71 , if you could complete the template with config and error logs, that should help with diagnosis.

3

Hello,
Thank you for your interest.
I am not getting any errors, but the certificate being presented is incorrect.
Here is the context:
I have four different publications, each with its own Let’s Encrypt certificate. Three of them present the correct certificate, while the last one presents the certificate belonging to another publication.
For example:
example.com → ‘example.com’ certificate
examplecam.com → ‘examplecam.com’ certificate
examplemeteo.com → ‘examplemeteo.com’ certificate
examplevideo.com → ‘example.com’ certificate
The paths to the certificates are correct.
There are four separate configuration files.
Thank you for your help.

4

Hi there,

nginx will do exactly what its config file tells it to do, or else there’s a bug.

You can possibly get a useful-enough extract of the relevant parts of the config by running the command

nginx -T | grep -E 'server|listen'

which should show the server{} blocks, and at least some part of the matching server_name and listen directives.

(If you are not using the compile-time default config file, then add “-c your-config-file” before the “-T”.)

If you want to keep names or addresses private, do feel free to replace them before replying with things like example.com and 10.0.0.1; but please make sure to replace things consistently – so make “ip#1” become 10.0.0.1 everywhere, and make “ip#2” become 10.0.0.2 everywhere.

My “most likely” guesses are that the IPs in the listen directives are not all the same; or that the server_name directives have examplevideo.com in an unexpected place.

But hopefully from the running-config extract it will be clear where to look next.

Cheers,

5

Hello,
Thank you for your help. Here is the output of the `nginx -T` command. This provides a complete view of my entire configuration.
Thank you very much.

nginx_certificate_error.txt (19.3 KB)

6

Hi there,

the IPs in the listen directives are not all the same.

If you change the entry from

# configuration file /etc/nginx/sites-enabled/examplevideo.conf:
server {
    server_name examplevideo.ddns.net;
...
    listen 443 ssl;

to be the equivalent of

    listen 10.0.0.1:443 ssl;

and restart nginx, then it should all Just Work the way you want it to.

Effectively, your current config says that any connection to 10.0.0.1:443 will be handled by “server_name example.ddns.net;” unless the request is for the name examplecam.ddns.net or examplemeteo.ddns.net; and any connection to any-other-local-ip:443 will be handled by “server_name examplevideo.ddns.net;”. I think that you have reported seeing the first half of that, and I suspect that you have not yet tested for the second half.

So either change the one “listen 443 ssl” to be “listen 10.0.0.1:443 ssl”; or change the three “listen 10.0.0.1:443 ssl” to be “listen 443 ssl”.

You are currently in the state described as “Mixed name-based and IP-based virtual servers” on How nginx processes a request, because “listen 443” is implicitly “listen *:443”, and is considered to be not-a-match when a connection comes in on an explicitly-configured IP.

Cheers,

7

Hello,
Thank you very much, my problem is solved with the same ‘listen’.