Otdfbt

I have a server that is going to host many sites, but right now there are just two. site1 (http://site1.com) is http and site2 (https://site2.com) is https. Both of these sites are node.js based and running off different ports, and I use nginx's proxy_pass to route the domain to the port.

The problem i'm having right now is that you can navigate to https://site1.com but it loads the website for site2 as https://site1.com. Obviously this is not good, as google has indexed the https pages under the wrong domain.

I'm not good with nginx yet, but my current config must be saying to route all https traffic to this port. In the future i'll have multiple https and http sites and obviously all the traffic needs to route properly.

Can anyone take a look at my config and school me as to what i'm doing wrong here?

My nginx.conf file is the default

here is my http://site1.com config

server

 listen 80;
 listen [::]:80;
 server_name site1.com www.site1.com;

 location /
 
 proxy_pass http://127.0.0.1:3103;
 include /etc/nginx/proxy_params;
 

and here is my https://site2.com config

server 
 listen 80;
 listen [::]:80;
 server_name site2.com www.site2.com;
 return 301 https://$host$request_uri;


server 
 listen 443 ssl;
 server_name site2.com;

 ssl_certificate /etc/nginx/ssl/site2_com.crt;
 ssl_certificate_key /etc/nginx/ssl/site2_com.key;

 location / 
 proxy_set_header Host $host;
 proxy_set_header X-Real-IP $remote_addr;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_set_header X-Forwarded-Proto $scheme;

 proxy_pass "http://127.0.0.1:3101";

 # rewrite redirects to http as to https
 proxy_redirect http:// https://;
 

Any advice and questions are welcome! Let me know if you need anymore context. Thanks!

Nginx always has a default server it uses to process requests where the server_name does not match. If you do not specify one explicitly using the default_server attribute, it will choose the first one with a matching listen directive.

In your case, the server block for site2 is used to process any https connection, albeit with an invalid certificate warning.

You can define a "catch all" server block, so that the server_name must match for each of your legitimate server blocks.

For example:

server 
 listen 80 default_server;
 listen 443 ssl default_server;
 return 444;

It will work fine for http connections. However, https connections are always problematic, as you cannot be expected to have valid certificates for every bogus domain name that points to your server. This will at least prevent the wrong server block from handling a request.

See this document for details.