3

I'm trying to add a second SSL enabled site to my NGinX configuration. Everything works fine with just one SSL enabled site, but when I add the second conf -- which is just an edited and copied conf from the working site -- I get the following error.

Note: I have tested and if I remove the new site, the conf passes and vice versa, if I remove the old site, the new one works.

root@NGinX:/etc/nginx/sites-enabled# ytitconf
 * Reloading nginx configuration nginx                                                           [fail]
nginx: [emerg] "ssl_certificate" directive is duplicate in /etc/nginx/sites-enabled/ytit.conf:2
nginx: configuration file /etc/nginx/nginx.conf test failed

Here is the VERY simple configuration in its whole.

Note: The second site hosts multiple subdomains, but this site will not be hosting subdomains at the moment.

root@NGinX:/etc/nginx/sites-available# cat ytit.conf
#GLOBAL SSL
ssl_certificate /etc/ssl/certs/ssl-bundle-ytit.crt;
ssl_certificate_key /etc/ssl/private/server-ytit.key;


server {
       listen         80;
       server_name    www.ytit.ca ytit.ca;

       return         301 https://$server_name/;
}

server {
listen 443 ssl;
ssl on;
server_name www.ytit.ca ytit.ca;
access_log /var/log/nginx/nginx.vhost.access.log;
error_log /var/log/nginx/nginx.vhost.error.log;

location / {

      proxy_pass           https://192.168.1.169:443/;
      include             /etc/nginx/proxy.conf;

    }
}

Here is NGinX.conf; I don't think its modified, but I set up NGinX almost a year ago and don't remember to be honest, so I'm including it as the error says it's with NGinX.conf test.

root@NGinX:/etc/nginx/sites-available# cat /etc/nginx/nginx.conf
user www-data;
worker_processes 4;
pid /run/nginx.pid;

events {
        worker_connections 768;
        # multi_accept on;
}

http {

        ##
        # Basic Settings
        ##

        sendfile on;
        tcp_nopush on;
        tcp_nodelay on;
        keepalive_timeout 65;
        types_hash_max_size 2048;
        # server_tokens off;

        # server_names_hash_bucket_size 64;
        # server_name_in_redirect off;

        include /etc/nginx/mime.types;
        default_type application/octet-stream;

        ##
        # Logging Settings
        ##

        access_log /var/log/nginx/access.log;
        error_log /var/log/nginx/error.log;

        ##
        # Gzip Settings
        ##

        gzip on;
        gzip_disable "msie6";

        # gzip_vary on;
        # gzip_proxied any;
        # gzip_comp_level 6;
        # gzip_buffers 16 8k;
        # gzip_http_version 1.1;
        # gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;

        ##
        # nginx-naxsi config
        ##
        # Uncomment it if you installed nginx-naxsi
        ##

        #include /etc/nginx/naxsi_core.rules;

        ##
        # nginx-passenger config
        ##
        # Uncomment it if you installed nginx-passenger
        ##

        #passenger_root /usr;
        #passenger_ruby /usr/bin/ruby;

        ##
        # Virtual Host Configs
        ##

        include /etc/nginx/conf.d/*.conf;
        include /etc/nginx/sites-enabled/*;
}


#mail {
#       # See sample authentication script at:
#       # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
#
#       # auth_http localhost/auth.php;
#       # pop3_capabilities "TOP" "USER";
#       # imap_capabilities "IMAP4rev1" "UIDPLUS";
#
#       server {
#               listen     localhost:110;
#               protocol   pop3;
#               proxy      on;
#       }
#
#       server {
#               listen     localhost:143;
#               protocol   imap;
#               proxy      on;
#       }
#}

nothing extra in conf.d

root@NGinX:/etc/nginx/conf.d# ll
total 8
drwxr-xr-x 2 root root 4096 Jul 29  2015 ./
drwxr-xr-x 5 root root 4096 Mar  8  2016 ../
0

1 Answer 1

3

Your main config file contains the line include /etc/nginx/sites-enabled/* which drags in all config files within the named directory sequentially.

All directives not within named context default to the global context, therefore by defining ssl_certificate and ssl_certificates in the top level of these files you are redefining a global directive, which causes NginX to complain.

Your options are:

  • Move the ssl_certificate and ssl_certificates inside a server context, which allows you to configure different certificates for different sites;
  • Only have the ssl_certificate and ssl_certificates directives in just one of these site conf files in a global context which makes it cover all your servers. Alternatively, moving it to the top level nginx.conf file will have the same effect.

Note that from version 1.11 you can have multiple ssl_certificate and ssl_certificates directives to cover different certificate types (RSA,ECDSA etc).

1
  • I understand, so what I do now is my "oddball" sites get SSL inside the server block while my main site which is constantly having subdomains added/removed has the SSL in the global block so I don't have to add it to each subdomain. Oct 16, 2018 at 18:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .