<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">Hi all,<div><br></div><div>Had a chat with a helpful person on IRC but both are stumped as to why my configuration passes a check (nginx -t) but fails to properly handle SSL.</div><div><br></div><div>– I’ve split a couple of repetitive blocks out into /etc/nginx/includes/ssl.conf (-rw-r--r-- root:root - same as nginx.conf - should not be a problem)</div><div><b>– Doing so results in SSL handshake issues (and the connection fails appropriately)</b></div><div>– My cert covers both the root domain and www</div><div>– An excerpt of my configuration is here: <a href="http://p.ngx.cc/8796278344c60dcb">http://p.ngx.cc/8796278344c60dcb</a> — but the relevant part is below:</div><div><pre> <span class="c1" style="color: rgb(64, 128, 128); font-style: italic;"># re-direct non-www https to https</span>
<span class="k" style="color: rgb(0, 128, 0); font-weight: bold;"><a href="http://ngx.cc/r/server" target="_blank" style="color: rgb(0, 128, 0);">server</a></span> <span class="p">{</span>
<span class="kn" style="color: rgb(0, 128, 0); font-weight: bold;"><a href="http://ngx.cc/r/listen" target="_blank" style="color: rgb(0, 128, 0);">listen</a></span> <span class="mi" style="color: rgb(102, 102, 102);">443</span> <span class="s" style="color: rgb(186, 33, 33);">ssl</span><span class="p">;</span>
<span class="kn" style="color: rgb(0, 128, 0); font-weight: bold;"><a href="http://ngx.cc/r/server_name" target="_blank" style="color: rgb(0, 128, 0);">server_name</a></span> <span class="s" style="color: rgb(186, 33, 33);"><a href="http://example.com">example.com</a></span><span class="p">;</span>
<span class="kn" style="color: rgb(0, 128, 0); font-weight: bold;"><a href="http://ngx.cc/r/include" target="_blank" style="color: rgb(0, 128, 0);">include</a></span> <span class="s" style="color: rgb(186, 33, 33);">/etc/nginx/includes/ssl.conf</span><span class="p">;</span>
<span class="kn" style="color: rgb(0, 128, 0); font-weight: bold;"><a href="http://ngx.cc/r/return" target="_blank" style="color: rgb(0, 128, 0);">return</a></span> <span class="mi" style="color: rgb(102, 102, 102);">301</span> <span class="s" style="color: rgb(186, 33, 33);"><a href="https://www.example.com">https://www.example.com</a></span><span class="nv" style="color: rgb(25, 23, 124);">$request_uri</span><span class="p">;</span>
<span class="p">}</span>
<span class="k" style="color: rgb(0, 128, 0); font-weight: bold;"><a href="http://ngx.cc/r/server" target="_blank" style="color: rgb(0, 128, 0);">server</a></span> <span class="p">{</span>
<span class="kn" style="color: rgb(0, 128, 0); font-weight: bold;"><a href="http://ngx.cc/r/listen" target="_blank" style="color: rgb(0, 128, 0);">listen</a></span> <span class="mi" style="color: rgb(102, 102, 102);">443</span> <span class="s" style="color: rgb(186, 33, 33);">ssl</span> <span class="s" style="color: rgb(186, 33, 33);">default_server</span><span class="p">;</span>
<span class="kn" style="color: rgb(0, 128, 0); font-weight: bold;"><a href="http://ngx.cc/r/server_name" target="_blank" style="color: rgb(0, 128, 0);">server_name</a></span> <span class="s" style="color: rgb(186, 33, 33);"><a href="http://www.example.com">www.example.com</a></span><span class="p">;</span>
<span class="kn" style="color: rgb(0, 128, 0); font-weight: bold;"><a href="http://ngx.cc/r/include" target="_blank" style="color: rgb(0, 128, 0);">include</a></span> <span class="s" style="color: rgb(186, 33, 33);">/etc/nginx/includes/ssl.conf</span><span class="p">;</span>
<span class="kn" style="color: rgb(0, 128, 0); font-weight: bold;"><a href="http://ngx.cc/r/root" target="_blank" style="color: rgb(0, 128, 0);">root</a></span> <span class="s" style="color: rgb(186, 33, 33);">/srv/www/<a href="http://www.example.com/public">www.example.com/public</a></span><span class="p">;</span>
<span class="kn" style="color: rgb(0, 128, 0); font-weight: bold;"><a href="http://ngx.cc/r/error_page" target="_blank" style="color: rgb(0, 128, 0);">error_page</a></span> <span class="mi" style="color: rgb(102, 102, 102);">502</span> <span class="mi" style="color: rgb(102, 102, 102);">503</span> <span class="mi" style="color: rgb(102, 102, 102);">504</span> <span class="s" style="color: rgb(186, 33, 33);">/5xx.html</span><span class="p">;</span>
<span class="c1" style="color: rgb(64, 128, 128); font-style: italic;"># rest of config (proxy pass to Go server)</span>
<span class="c1" style="color: rgb(64, 128, 128); font-style: italic;"># STS header in location block, etc.</span>
<span class="p">}</span>
</pre></div><div><span class="p">If I move the include directive (effectively removing the duplication) into the http block and put the ssl_certificate and ssl_certificate_key directives into each of the two (2) server blocks instead of includes/ssl.conf, all is well. But this conflicts with the documentation (as I interpret it) and still results in some duplicated configuration.</span></div><div><span class="p"><br></span></div><div><span class="p">Ideally I want to drop the entire “SSL config” for these two domains into a includes file that I can then just import into the server blocks. If that’s not entirely possible, that’s okay — but configs I’ve seen out in the wild (</span><a href="https://github.com/igrigorik/istlsfastyet.com/blob/master/nginx/includes/ssl.conf">https://github.com/igrigorik/istlsfastyet.com/blob/master/nginx/includes/ssl.conf</a>) seem to do what I’m trying to achieve :)</div><div><br></div><div>Cheers,</div><div>Matt</div></body></html>