SNI for multiple SSL certificates in Nginx - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

Nginx SNI Configuration Output

Given the following Nginx server block configuration for two domains using SNI, what will be the output of curl -v https://site1.example.com assuming both certificates are valid and correctly installed?

Nginx

server {
    listen 443 ssl;
    server_name site1.example.com;
    ssl_certificate /etc/nginx/ssl/site1.crt;
    ssl_certificate_key /etc/nginx/ssl/site1.key;
}

server {
    listen 443 ssl;
    server_name site2.example.com;
    ssl_certificate /etc/nginx/ssl/site2.crt;
    ssl_certificate_key /etc/nginx/ssl/site2.key;
}

A SSL connection established with certificate for site2.example.com

B SSL connection established with certificate for site1.example.com

C SSL handshake fails with certificate mismatch error

D Nginx returns 404 Not Found error

💡 Hint

Remember that SNI allows the server to present the correct certificate based on the requested domain name.

With SNI enabled, Nginx selects the correct SSL certificate based on the domain requested by the client. Since the request is for site1.example.com, Nginx presents the site1 certificate, allowing a successful SSL handshake.

❓ Configuration

intermediate

Correct Nginx SNI Server Block for Multiple Domains

Which of the following Nginx server block configurations correctly enables SNI for two domains with separate SSL certificates on the same IP and port?

A

server {
    listen 443;
    server_name domain1.com;
    ssl_certificate /etc/ssl/domain1.crt;
    ssl_certificate_key /etc/ssl/domain1.key;
}
server {
    listen 443;
    server_name domain2.com;
    ssl_certificate /etc/ssl/domain2.crt;
    ssl_certificate_key /etc/ssl/domain2.key;
}

B

server {
    listen 443 ssl;
    server_name domain1.com domain2.com;
    ssl_certificate /etc/ssl/domain1.crt;
    ssl_certificate_key /etc/ssl/domain1.key;
}

C

server {
    listen 443 ssl;
    server_name domain1.com;
    ssl_certificate /etc/ssl/domain1.crt;
    ssl_certificate_key /etc/ssl/domain1.key;
}
server {
    listen 443 ssl;
    server_name domain2.com;
    ssl_certificate /etc/ssl/domain2.crt;
    ssl_certificate_key /etc/ssl/domain2.key;
}

D

server {
    listen 443 ssl;
    server_name domain1.com;
    ssl_certificate /etc/ssl/domain2.crt;
    ssl_certificate_key /etc/ssl/domain2.key;
}
server {
    listen 443 ssl;
    server_name domain2.com;
    ssl_certificate /etc/ssl/domain1.crt;
    ssl_certificate_key /etc/ssl/domain1.key;
}

💡 Hint

Each domain needs its own server block with its own SSL certificate and key.

Option C correctly defines two separate server blocks listening on port 443 with SSL enabled, each with its own domain name and matching SSL certificate and key. This setup enables SNI to serve the correct certificate per domain.

❓ Troubleshoot

advanced

Diagnosing SSL Certificate Mismatch with SNI

A user reports that when accessing https://example.com, the browser shows a certificate warning for a different domain. The Nginx config has multiple server blocks with SSL certificates for different domains. What is the most likely cause?

A The SSL certificates are expired and causing the mismatch warning.

B The DNS for example.com is pointing to the wrong IP address.

C The listen directive is missing 'ssl' in the server block for example.com.

D The default server block is serving a certificate that does not match example.com because no server block matches example.com explicitly.

💡 Hint

Check which server block Nginx uses when no exact server_name match is found.

If no server block matches the requested domain, Nginx uses the default server block, which may have a certificate for another domain, causing a mismatch warning. Explicitly defining a server block for example.com fixes this.

🔀 Workflow

advanced

Steps to Enable SNI for Multiple SSL Sites on Nginx

What is the correct order of steps to enable SNI for multiple SSL sites on a single Nginx server?

A 1,2,3,4

B 3,1,2,4

C 1,3,2,4

D 2,1,3,4

💡 Hint

Think about the logical order from obtaining certificates to applying configuration.

First, you must have certificates (step 1), then configure server blocks (step 2), enable SSL listening (step 3), and finally reload Nginx (step 4) to activate the setup.

✅ Best Practice

expert

Best Practice for Managing Multiple SSL Certificates with SNI

Which practice is best to ensure smooth management and security when using SNI with multiple SSL certificates on Nginx?

A Store SSL certificates and keys in a dedicated, secure directory with proper permissions and automate renewal with tools like Certbot.

B Use a single wildcard certificate for all domains to simplify configuration.

C Disable SNI and use IP-based SSL to avoid certificate mismatches.

D Combine all domain certificates into one file and reference it in all server blocks.

💡 Hint

Think about security and automation for multiple certificates.

Storing certificates securely and automating renewal reduces human error and improves security. Using Certbot or similar tools helps keep certificates up to date without manual intervention.