I have a working NGINX configuration with SNI enabled and I am able to server two different SSL Certificates based on the incoming request Host header.
What I would need is to be able to configure NGINX to use a different header and not use Host for this 'routing' done based on the header. Does anyone know if this is possible?
The Host header isn't used to determine which certificate you get from the server.
The TLS handshake begins with a ClientHello, and your client provides the hostname (SNI) as a part of this handshake. The server then responds with the correct certificate. (In the case of NGINX, if you request a server name it doesn't know about, it will respond with the first certificate defined in its configuration.)
After the TLS setup, your client makes an HTTP request which includes the Host
header. Normally, this will match the SNI part of the ClientHello.
It's likely that the client you are testing with takes the Host
header you are setting and uses that to set SNI for the TLS handshake, but they are unrelated and don't even need to match.
To illustrate this point, you could use openssl s_client -connect <server_ip>:443 -servername Test1
and then send the following request:
GET / HTTP/1.1
Host: Test2
You will see that you get the certificate for Test1
before you even make the HTTP request. The server will send a response back from Test2
. Voila, proof that the Host
header is not doing what you think it is.
You can abuse NGINX to use an arbitrary header besides Host, but that does not solve the client SNI issue. See this answer for an example of using proxy_pass
based on the request body, and modify it to use a header instead: nginx conditional proxy pass