The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Yes, Nginx can serve different SSL/TLS certificates for multiple HTTPS domains sharing one IP address. The required mechanism is TLS Server Name Indication (SNI): create one HTTPS server block per hostname, make every block listen on port 443, and assign each block its own server_name, certificate, and private key.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
During the TLS handshake, the browser sends the requested hostname in SNI. Nginx uses that name to select the correct virtual server and certificate, then uses the HTTP Host header to finish routing the request. The procedure below covers certificate files, configuration, validation, compatibility limits, and the causes of a wrong certificate.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsHow SNI makes multiple certificates on one IP possible
Without hostname information, a server receiving a connection on one IP address and port would have no reliable way to know which certificate to present. SNI adds the hostname to the TLS ClientHello message before HTTP begins. Nginx can therefore select a certificate for www.example.com even when www.example.org uses the same address and port.
Nginx initially creates the connection in the default-server context for that address and port. If the client sends SNI, Nginx selects the matching virtual server during the TLS handshake. After encryption is established, the request line and HTTP Host header provide another opportunity to select the server. A missing SNI value, a hostname that does not match any server_name, or a request made directly to the numeric IP can leave the connection on the default server and produce its certificate.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
SNI is a hostname-routing feature, not a way to put several unrelated certificates into one ordinary certificate file. Each hostname needs a certificate whose Subject Alternative Name (SAN) set covers that name, unless you deliberately use a SAN or wildcard certificate that covers several names.
Prerequisites and version checks
Before editing the configuration, verify that the Nginx build and its TLS library can use SNI.
- Run
nginx -Vand check the output for the HTTP SSL module and the SNI support indication documented by Nginx. - Confirm that the runtime OpenSSL library also supports SNI. A dynamically linked library lacking the required TLS-extension support can prevent SNI even when the Nginx binary itself was built with SSL support.
- Have a separate certificate and private key for every hostname, or choose a SAN or wildcard certificate whose names genuinely cover the sites.
- Ensure DNS for each hostname resolves to the shared public IP address and that TCP port 443 reaches this Nginx instance.
- Make sure the certificate SAN list exactly matches the hostname users will enter. A certificate for
example.comdoes not automatically coverwww.example.com, and the reverse is also true.
The Nginx module documentation records these relevant feature milestones:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
| Feature | Documented since | What it means here |
|---|---|---|
| SNI support | Nginx 0.5.23 | Allows hostname-based certificate selection during the TLS handshake. |
ssl parameter on listen |
Nginx 0.7.14 | Enables TLS for a listening HTTPS server block. |
| Variable certificate filenames | Nginx 1.15.9 | Permits variables in certificate-file paths for advanced dynamic configurations. |
| Certificate caching | Nginx 1.27.4 | Provides the newer certificate-cache behavior described in the module reference. |
These are feature-version milestones, not promises of a performance increase. On a packaged distribution, the exact Nginx and OpenSSL versions come from that operating system’s repositories.
Prepare the certificate and key files
Build the correct PEM chain
For each site, store a PEM file with the leaf certificate first, followed by the intermediate certificates supplied by the certificate authority. The usual arrangement is one fullchain.pem containing the site certificate and its intermediates, plus a separate privkey.pem containing the private key.
Do not put the private key into the publicly served document root. Keep it in a root-controlled TLS directory and grant only the Nginx master process (or the account it starts under) the read access required to load it. The exact owner and mode vary by distribution; the important checks are that unprivileged users cannot read the key and that Nginx can read it during configuration testing and startup.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Match names before configuring
Inspect every certificate’s SAN entries and compare them character-for-character with the names in the planned server_name directives. Include both apex and www names when users can reach both, unless the certificate explicitly lists both. A valid chain with the wrong SAN still produces a browser name error.
Configure one HTTPS server block per hostname
Place the following blocks inside the existing http context in nginx.conf or an included file. Both blocks use the same address and port; only the hostname, certificate paths, and site root differ.
http {
server {
listen 443 ssl;
server_name www.example.com;
ssl_certificate /etc/nginx/tls/www.example.com/fullchain.pem;
ssl_certificate_key /etc/nginx/tls/www.example.com/privkey.pem;
root /srv/www/example-com;
}
server {
listen 443 ssl;
server_name www.example.org;
ssl_certificate /etc/nginx/tls/www.example.org/fullchain.pem;
ssl_certificate_key /etc/nginx/tls/www.example.org/privkey.pem;
root /srv/www/example-org;
}
}Use a unique server_name in each block. The certificate and key directives must refer to the matching hostname’s files. If you add aliases, list only names covered by that certificate’s SAN set.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Optional HTTP-to-HTTPS redirect
If the sites should redirect ordinary HTTP traffic, create a separate port-80 block for each hostname and return a redirect that preserves the requested host and URI. Keep the TLS certificate directives in the port-443 blocks; port 80 does not perform a TLS handshake.
Choosing a default server
Nginx uses one server as the default for an address and port when no better match exists. Do not treat the default certificate as evidence that every site is configured correctly. A client that omits SNI, sends an unknown name, or connects by IP can legitimately receive that default certificate.
Validate safely, then reload Nginx
- Check each certificate file, key file, and intermediate chain path for spelling and permissions.
- Run
nginx -t. Continue only when Nginx reports that the syntax test is successful and the configuration test is valid. - Reload Nginx through the service manager used by your operating system. The exact command differs between systemd, OpenRC, containers, and other platforms, so use that platform’s documented reload operation rather than assuming one command.
- Test every hostname with an explicit SNI value:
openssl s_client -connect 203.0.113.10:443 -servername www.example.com. Replace the example address and name with the real endpoint, then inspect the returned certificate and its SAN entries. - Repeat the test for the second hostname and any aliases. A test that connects only to the numeric IP does not prove that SNI routing works, because it intentionally supplies no matching hostname.
The openssl s_client output can also reveal an incomplete chain, an unreadable key, or a certificate whose subject names do not match the requested host. Resolve those findings before relying on browser tests.
Diagnose a wrong certificate or failed handshake
| Symptom | Likely cause | Targeted fix |
|---|---|---|
| The second domain shows the first domain’s certificate. | The request is reaching the default server, the client sent no SNI, or the server_name does not exactly match the SNI name. |
Test with -servername, verify DNS and the spelling of every server_name, and check which block is the default. |
| Nginx refuses to reload after a certificate change. | A file path is wrong, the PEM is malformed, the key does not match the certificate, or Nginx cannot read the file. | Run nginx -t, correct the path or permissions, and confirm that the private key belongs to the configured leaf certificate. |
| Browsers report an untrusted or incomplete chain. | The PEM contains only the leaf certificate and omits one or more intermediates. | Put the leaf certificate first and append the required intermediate certificates in the configured certificate file. |
| The certificate is valid but the browser reports a name mismatch. | The requested hostname is absent from the certificate SAN set. | Issue or select a certificate that lists the exact hostname, or change the hostname to one the certificate covers. |
| Modern browsers work but an older client receives the default certificate. | The client does not send SNI. | Use separate IP addresses for compatibility with non-SNI clients, or accept that those clients cannot reliably select among names on one IP. |
| An IP-address URL shows an unexpected certificate. | An IP request supplies no DNS hostname for SNI and normally lands on the default server. | Test and publish the service using its hostname; configure an IP certificate only if clients are intentionally expected to use the IP. |
Choose the right certificate and addressing strategy
SNI with separate certificates is not the only design. Compare the alternatives against your client base, the number and shape of names, certificate-management effort, and IP availability.
| Approach | Best fit | Compatibility and limits | Management trade-off |
|---|---|---|---|
| Separate certificates with SNI | Independent sites or customers sharing one address. | Works for SNI-capable clients; non-SNI clients receive the default certificate. | Each hostname has its own renewal, key, chain, and Nginx block. |
| One SAN certificate | A known group of exact names controlled by one operator. | One certificate can list several names, but the SAN field has a finite size and every required name must be listed. | Fewer files and renewals, but adding or removing names requires replacing the shared certificate. |
| Wildcard certificate | Many hosts at one subdomain level, such as app.example.org and api.example.org. |
A wildcard such as *.example.org does not cover the apex example.org or a deeper name such as www.sub.example.org. |
One key protects many hosts, so key access and renewal deserve stricter controls. |
| Separate IP addresses | Legacy or controlled clients that do not send SNI, or strict isolation requirements. | Each address can have an unambiguous default certificate and does not depend on SNI. | Requires additional routable addresses and corresponding DNS, firewall, and monitoring changes. |
Nginx’s documentation describes SNI as the more generic solution for running several HTTPS servers on a single IP address. Separate IPs remain the robust fallback when client compatibility is more important than address conservation.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Advanced Nginx certificate patterns
Share one certificate at HTTP scope
When several server blocks intentionally use the same certificate and key, defining ssl_certificate and ssl_certificate_key at http scope lets those servers inherit the settings and share one in-memory copy. This is useful for a group of names covered by the same SAN or wildcard certificate. Do not use this pattern when the blocks require different certificates.
Serve RSA and ECDSA certificates together
Current Nginx can repeat ssl_certificate and ssl_certificate_key for different certificate types, such as RSA and ECDSA, when the linked OpenSSL capabilities support them. This lets compatible clients negotiate an appropriate certificate type while retaining a fallback for clients that need the other type. Confirm support in the Nginx and OpenSSL versions installed on the host before deploying this arrangement.
Variable certificate filenames
Nginx documents variable certificate filenames from version 1.15.9. Dynamic paths can reduce repetitive configuration in carefully controlled systems, but they add validation and file-lookup complexity. Static, explicit paths are easier to audit for a small number of sites; use variables only when the naming scheme, permissions, and reload process are managed deliberately.
Operate and renew multiple certificates safely
- Keep each site’s leaf certificate, chain, and private key in a predictable directory so renewals cannot accidentally overwrite another hostname’s files.
- After every renewal, verify that the new certificate still contains all names listed in the corresponding
server_namedirective. - Run
nginx -tbefore every reload. A successful file replacement is not the same as a successful configuration load. - Use an explicit SNI test for each hostname after reloading and inspect the served certificate, not just the process status.
- Restrict private-key access and include key-file permissions in routine audits.
- Record which certificate is the default for the shared listener so an unknown-name or non-SNI request has a deliberate, safe outcome.
With those controls, adding another site is a repeatable operation: obtain a certificate whose SANs cover the hostname, place the chain and key in protected paths, add one matching HTTPS server block, test the configuration, reload, and verify with SNI.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
