Domain without ssl certificate redirecting to different ssl domain

Question

I have two domains set up on a Digital Ocean droplet (with nginx). I've installed a SSL certificate in one of them (domain1) and everything is fine with that one. The second domain (domain2), does not require a SSL certificate but if I try to access https://domain2 is showing me the content of domain1 and giving me a certificate error (This page is not secure).

I understand the certificate error, but I don't want the contents of domain1 being displayed in https://domain2

Is it a configuration problem?

Answer 1

nginx always has a default server, the one that is used if the server_name does not match. If you only have one server block with listen 443, then that is the implicit default server for all https connections irrespective of server name.

You will need to set up an explicit catch-all server for https connections, or add listen 443 ssl to an existing server block to act as the catch-all server.

You can reuse the same certificate file and you will continue to get certificate errors if anyone attempts to use it, but at least your other domains will not be exposed.

For example:

ssl_certificate     /path/to/crt;
ssl_certificate_key /path/to/key;    

server {
    listen 443 ssl;
    server_name domain1;
    ...
}
server {
    listen 443 ssl default_server;
    return 403;
}

See this document and this document for more.