Would you like to set up multiple SSL certificates on one IP with Nginx? We can help you with it.

Here at Bobcares, we have seen several such Nginx related queries as part of our Server Management Services for web hosts and online service providers.

Today we’ll take a look at how to set up multiple SSL certificates on one IP with Nginx.

How we host multiple SSL certificates on one IP with Nginx

SNI ( Server Name Identification) allows hosting multiple SSL certificates on a single IP address.

Traditionally, separate SSL certificates for each site required separate IP addresses. However, this process is now simplified through the use of Server Name Indication (SNI).

Requirements to host multiple SSL certificates on one IP with Nginx

1. Registered domain names so that it can serve the certificates by SNI.
2. Nginx must already be installed and running on the VPS.
3. However, here is the command to install Nginx:
   # sudo apt-get install nginx
4. SNI must be enabled on the server. Here is the command that displays the version and status.
   # nginx -V

Setting up multiple SSL certificates on one IP with Nginx

Now let’s take a look at how our Support Engineers setup multiple SSL certificates.

1. First, we create an SSL certificate Directory.

Here, we are considering two domains example.com and example.org.

The SSL certificate has 2 main parts that is the certificate and the public key. We should create a directory for each virtual hosts SSL certificate.

# mkdir -p /etc/nginx/ssl/example.com
# mkdir -p /etc/nginx/ssl/example.org

2. Next, we create the Server Key and Certificate Signing Request

First, we create an SSL certificate for example.com.

# cd /etc/nginx/ssl/example.com

Then, we create a private server key. While creating, we need to enter a pass-phrase, which is needed later to access the certificate.

# sudo openssl genrsa -des3 -out server.key 1024

Now, we create a certificate signing request by running the below command.

# sudo openssl req -new -key server.key -out server.csr

This will prompt a terminal to display a list of fields that need to be filled in.

3. Remove the Passphrase

We need to remove the passphrase. Even though having the passphrase in place provides better security, the issue appears when one tries to reload the Nginx.

In the event that Nginx crashes or needs to reboot, we will always have to re-enter the passphrase to get the entire web server back online.

# sudo cp server.key server.key.org
# sudo openssl rsa -in server.key.org -out server.key

4. Sign the SSL Certificate

# sudo openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

This certificate will expire after one year.

We have done with the certificate in the first host.

In order to create the certificate in the first host, we switch the directory

# cd /etc/nginx/ssl/example.org

Then we repeat the previous three steps for the second certificate as well. After that, we start adding the certificates to the virtual hosts.

5. Create the Virtual Hosts

After having the certificates saved, we add our information to the virtual host file.

server {
listen 443;
server_name example.com;
root /usr/share/nginx/www;
index index.html index.htm;
ssl on;
ssl_certificate /etc/nginx/ssl/example.com/server.crt;
ssl_certificate_key /etc/nginx/ssl/example.com/server.key;
}

Each file will then contain the virtual host configuration as follows:

server {
listen 443;
server_name example.com;
root /usr/share/nginx/www;
index index.html index.htm;
ssl on;
ssl_certificate /etc/nginx/ssl/example.com/server.crt;
ssl_certificate_key /etc/nginx/ssl/example.com/server.key;
}

Also, we ensure that we have updated server_name, ssl_certificate, and ssl_certificate_key lines to match our details.

Then, we do the same for the second account :

# sudo nano /etc/nginx/sites-available/example.org
server {
listen 443;
server_name example.org;
root {Specify the document root for example.org};
index index.html index.htm;
ssl on;
ssl_certificate /etc/nginx/ssl/example.org/server.crt;
ssl_certificate_key /etc/nginx/ssl/example.org/server.key;
}

6. Activate the Virtual Hosts

Now, we activate the hosts by creating a symbolic link between the sites-available directory and the sites-enabled directory. For that, we run the below commands.

# sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/example.com
# sudo ln -s /etc/nginx/sites-available/example.org /etc/nginx/sites-enabled/example.org

7. Restart Nginx

Finally, we restart Nginx by running the below command.

# sudo service nginx restart

[Need any further assistance with Nginx related queries? – We’re available 24*7]

Conclusion

Today, we saw how our Support Engineers set up multiple SSL certificates on one IP with Nginx.