Note: See update below!

I have a Nginx setup regarding two domains, example1.org and example2.org, they're both handled at the same instance.

My problem is with example2.org, I want http://www.example2.org to redirect to https://example2.org, but when I type http://www.example2.org into the browser, I always end up with a "Privacy Error - Not secure" which lists the certificate of example1.org.

The problem seems to be that the default server part "wins" when resolving http://www.example2.org, which AFAIK, should not happen, and des not seem to happen

First in default.conf for example1.org, I have:

server {
    listen 443 ssl http2 default_server;
    listen [::]:443 ssl http2 default_server;
    server_name _;

    ssl_certificate /etc/letsencrypt/live/example1.org/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/example1.org/privkey.pem; # managed by Certbot
    ssl_session_tickets off;

    return 302 http://$host$request_uri;


Then in example2.org.conf I have

server {
        server_name www.example2.org;
        return 301 https://example2.org$request_uri;

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    server_name example2.org;
    root /opt/web-apps/example2.org/system/nginx-root; # Used for acme.sh SSL verification (https://acme.sh)

    ssl_certificate /etc/letsencrypt/example2.org/fullchain.cer;
    ssl_certificate_key /etc/letsencrypt/example2.org/example2.org.key;
    include /etc/nginx/snippets/ssl-params.conf;

    location / {
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $http_host;


    location ~ /.well-known {
        allow all;

    client_max_body_size 50m;

Any suggestions to what I am missing/doing wrong?



The browsers keep their own HSTS cache, which screws things up. Unfortunately there seems to be no way of disabling this serverside for a specific subdomain, like "www."...

  • You are missing a server block to handle https://www.example2.org. – Richard Smith Jul 12 at 6:02
  • Hm, I think maybe the question is a bit unclear, they're two different .conf-files, so basically they're the part of the same config. I have updated the question. – Gnimmelf Jul 12 at 19:23
  • My comment stands. You enter http://www.example2.com and the browser promotes it to https://www.example2.com because of HSTS rules. The latter URL is handled by default.conf as there is no other server block that matches. – Richard Smith Jul 12 at 19:41
  • @RichardSmith Ah, I see. -Care to elaborate , as I'd was trying to avoid certificates for https://www.example2.org, since I'm just using Cerbot, and have a about ten small sites that need to follwo the pattern... – Gnimmelf Jul 12 at 20:06
  • ...HSTS is supposed to be an opt-in [nginx.com/blog/http-strict-transport-security-hsts-and-nginx/], so where is it opted in? – Gnimmelf Jul 12 at 20:13

The problem is that http://www.example2.com is not being processed by the server block you expect.

If you enable HTTP Strict Transport Security for a domain, and include the "subdomains" clause, the browser will remember this for a very long time.

The browser automatically changes the http request to https://www.example2.com.

There is no server block that handles that domain name on port 443, so it is handled by the default server block, which uses the certificate for example1.com.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.