How to set up SSL certificates on nginx on the same host?

Question

Nginx

Hello! I have a question about setting up nginx to set up different SSL certificates on the same host.
One SSL certificate for the main domain - example.com
Second wildcard certificate for subdomains - sub.example.com
Here are the nginxa settings:
1. These are the settings for the main domain example.com

server {
    listen 127.0.0.1:8443 ssl http2;

    server_name example.com www.example.com;
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; # managed by Certbot
    include /etc/nginx/snippets/ssl-params.conf;

    location / {
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $http_host;
        proxy_pass http://127.0.0.1:1024;

    }

    location ~ /.well-known {
        allow all;
    }

    client_max_body_size 1m;


}

2. And these are the nginx settings for the sub.example.com subdomain:

server {
    listen 8443 ssl;
    server_name sub.example.com www.sub.example.com;
    ssl_certificate /etc/letsencrypt/live/sub.example.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/sub.example.com/privkey.pem; # managed by Certbot
    location / {
            root /var/www/goaccess;
            index  index.html;
            auth_basic "Restricted Area";
            auth_basic_user_file  htpasswd;

}
}

At the same time, when I go to sub.example.com, I get an error that the certificate is fake and does not match the address that I type in the browser. And the certificate of the main domain is shown. If I set a wildcard certificate in the main domain settings, then the subdomain opens (but for some reason the main site opens, but maybe I'll figure it out myself), but the main example.com domain opens with an error that the certificate is not suitable.
If anyone can help, please explain what is wrong. And what else can be added to the configuration files for the operation of two sites.

Answer 1

Because you are listening on one host on 127.0.0.1, and the second on all available network interfaces. Decide already.

Answer 2

A wildcard includes *.sub.example.com , such as www.sub.example.com , but does not include sub.example.com .
sub.example.com needs a separate certificate.