Stop your nginx instance from replying with the first valid SSL cert and nothing from port 80 when people hit the server without a valid hostname
# /etc/angie/http.d/default.conf
server {
listen 80 default_server;
listen [::]:80 default_server;
listen 443 ssl default_server;
listen [::]:443 ssl default_server;
server_name _;
# For NGINX < 1.19.4, use a dummy certificate
# ssl_certificate /path/to/dummy.crt;
# ssl_certificate_key /path/to/dummy.key;
# For NGINX >= 1.19.4, you can use:
ssl_reject_handshake on;
return 444;
}Testing
site1.com and site2.com don't have a web site configured site3 does...
# direct to IP
curl https://10.11.12.13
curl: (35) TLS connect error: error:0A000458:SSL routines::tlsv1 unrecognized name
curl http://10.11.12.13
curl: (52) Empty reply from server
# hostname but no site configured
curl http://site1.com
curl: (52) Empty reply from server
curl https://site1.com
curl: (35) TLS connect error: error:0A000458:SSL routines::tlsv1 unrecognized name
curl http://site2.com
curl: (52) Empty reply from server
curl https://site2.com
curl: (35) TLS connect error: error:0A000458:SSL routines::tlsv1 unrecognized name
# server with a configured host returns content for http/https
curl -s http://site3.com | head -n 5
<!DOCTYPE html>
<html lang="en-US">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1" />
curl -s -k https://site3.com | head -n 5
<!DOCTYPE html>
<html lang="en-US">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1" />
0 Comments