Default SSL certificates about server-configs-nginx HOT 3 CLOSED

That's more a question for nginx support (their irc room or forum) however I can give you an answer:

From wikipedia:

Server Name Indication (SNI) is an extension to the TLS protocol[1] that indicates what hostname the client is attempting to connect to at the start of the handshaking process. This allows a server to present multiple certificates on the same IP address and port number and hence allows multiple secure (HTTPS) websites (or any other Service over TLS) to be served off the same IP address without requiring all those sites to use the same certificate. It is the conceptual equivalent to HTTP/1.1 virtual hosting for HTTPS.

As I understand it when initiating a https request, the host name isn't known - it's only connecting to an ip address and hence, without SNI, the webserver doesn't know which certificate to serve up and therefore will use the default.

If I have Site A with SSL and Site B without SSL. I would usually add the SSL directives to the site specific configuration. So the Site A would have have those certificate directives, while the Site B won't.

If you only have one domain with SSL - SNI isn't a factor as there is only one domain using that IP address with https.

if I set the default certificates to site A's certificates, won't that mean when somebody accesses site B they may get site A's certificates?

In your example Site B doesn't have https - so the request would just fail. If however Site B did use https - yes that's exactly what would happen iff the client does not support SNI.

In what situation would anybody want to have a default certificate unless it was a multi domain wildcard certificate?

If you're using https you should I think always set a default - because the default certificate is by ip address, not hostname.

Also the keepalive_timeout should be optimised to 70 for ssl certificates right?

I don't think so this might give you some perspective on that.

from server-configs-nginx.

You mentioned that the default certificate is by ip address. Are you referring to the SSL certificate? When I bought a SSL cert, it was by hostname.

from server-configs-nginx.

Of course the certificate was purchased for a hostname - but establishing a secure connection to a server is by IP address.

If you need further nginx help, please use an appropriate place or since the question isn't actually nginx specific e.g. stackoverflow.

from server-configs-nginx.