How to block HTTPS requests to an IP address in Nginx?

Question

Nginx

Good day.

I want to make several sites on one physical server. I am using Nginx. At the same time, I do not want any of the sites to be opened by the IP address of the site or by a domain not configured in Nginx.

For HTTP, I made a similar config:

server {
  listen 80 default_server;
  
  location / {
    deny all;
  }
}

server {
  listen 80;
  server_name example.com;

  location / {
    # тут настройки
  }
}

And everything works great. If I open the site example.com - the required page opens in accordance with the description in location. If I try to open by IP or through another domain name that also refers to the same IP address, I get a 403 error.

And now I want to do the same with HTTPS.

If I change default_server settings like this:

server {
  listen 80 default_server;
  listen 443 ssl default_server;
  
  location / {
    deny all;
  }
}

server {
  listen 443 ssl;
  server_name example.com;

  ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
  ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;

  location / {
    # тут настройки
  }
}

Then when I access the site https://example.com I get an error in the Nginx log

[error] 5#5: *8 no "ssl_certificate" is defined in server listening on SSL port while SSL handshaking

And if I remove the line listen 443 ssl default_server from the default server, then when accessing from another domain or by ip: https://1.2.3.4 , the site https://example.com opens with an incorrect certificate.

How to properly block httpS requests for ip address in nginx?

Answer 1

server {
  listen 443 ssl default_server;
 
  ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
  ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;

  location / {
    deny all;
  }
}

It is important to understand that an HTTPS site requires some kind of certificate specified in the config. Certificates are not issued for IP addresses, so you will have to slip some kind of left one. Therefore, when trying to access a domain that does not exist for you or by IP address, the user will first receive a warning about the invalidity of the certificate, and only after that - a 403 error.